Azure Key Vault CSI driver fails with multiple user assigned identities

The project addressed an issue with the Azure Key Vault CSI driver in Azure Kubernetes Service (AKS), where secret mounts failed due to multiple user-assigned managed identities on the AKS nodes. The error message Multiple user assigned identities exist, please specify the clientId occurred because the driver could not automatically determine which identity to use for Key Vault access when the SecretProviderClass lacked an explicit clientId.

Issue

The Key Vault CSI driver failed to mount secrets when the SecretProviderClass resource had an empty userAssignedIdentityID field while the AKS node had multiple managed identities assigned. This led to a scheduling error that prevented secret mounting, disrupting pod initialization and access to secure configurations.

Culprit

The issue stemmed from the CSI driver’s identity resolution logic, which requires explicit specification of the identity when multiple identities are present. Without a defined clientId, the driver could not automatically select an appropriate identity for Key Vault authentication, resulting in the error.

Solution

Identity Verification

To resolve the issue, the correct identity client ID was identified using Azure CLI tools. This step ensured that the right identity was specified for Key Vault access.

Configuration Update

The SecretProviderClass configuration was updated to explicitly specify the client ID of the identity to use for Key Vault access. This change provided the necessary disambiguation for the CSI driver to successfully authenticate and mount secrets.

This solution ensured that the CSI driver could resolve the correct identity for Key Vault access, enabling seamless secret mounting and improving security and reliability in the AKS environment.