Application running in AKS gets 403 forbidden by rbac when using service principal to fetch secret in keyvault.

Question

The service principal has key vault secrets user in the resource group where the keyvault is.
The pod authenticates with az --service-principal -n [app_id] -p [secret] --tenant [tenant id] The service principal have had keyvault admin role, but with the same outcome. Attaching to the pod and listing secrets works but in the context of the application it doesn't. The application is an agent for a SaaS.--

best
frustrated dev seeking information and rubber ducking.

Answer 1

Hi @Krister Borge (Innleid) , sorry to hear you're having issues! We can try a few troubleshooting steps. If they don't work we can open a support ticket for you!

Please try the following steps and let me know your results:

1. Check if the service principal has the correct permissions to access the Key Vault. Make sure that the service principal has the "Key Vault Secrets User" role assigned to it in the resource group where the Key Vault is located.
2. Verify that the service principal is correctly authenticated. You can do this by attaching to the pod and running the az command to list the secrets. If this works, then the authentication is correct.
3. Check if the RBAC permissions are correctly set up. Make sure that the service principal has the correct permissions to access the Key Vault. You can try assigning the "Key Vault Administrator" role to the service principal to see if this resolves the issue.
4. If the above steps do not work, you can try using Managed Identity for your application. This will allow your application to authenticate with Azure services without the need for a service principal. You can follow the steps in the following document to enable Managed Identity for your application: https://docs.microsoft.com/en-us/azure/aks/use-managed-identity

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James