csi-driver | HashiCorp Vault CSI Driver for Kubernetes | Identity Management library

It’s a daemonset.

kubectl -n kube-system edit ds/efs-csi-node

The CSI secret store driver is a container storage interface driver - it can only mount to files.

For postgres specifically, you can use docker secrets environment variables to point to the path you're mounting the secret in and it will read it from the file instead. This works via appending _FILE to the variable name.

Per that document: Currently, this is only supported for POSTGRES_INITDB_ARGS, POSTGRES_PASSWORD, POSTGRES_USER, and POSTGRES_DB.

Looks it is related to the default network plugin that AKS picks for you if you don't specify "Advanced" for network options: kubenet.

This integration can be done with kubenet outlined here:

https://azure.github.io/aad-pod-identity/docs/configure/aad_pod_identity_on_kubenet/

If you are creating a new cluster, enable Advanced networking or add the --network-plugin azure flag and parameter.

Yes, the way you had shown is the correct one for achieving it. You can get more information about the kustomization provider here.

According to the official docs:

This command installs a chart archive.

The install argument must be a chart reference, a path to a packaged chart, a path to an unpacked chart directory or a URL.

To override values in a chart, use either the –values flag and pass in a file or use the –set flag and pass configuration from the command line. To force string values in –set, use –set-string instead. In case a value is large and therefore you want not to use neither –values nor –set, use –set-file to read the single large value from file.

CHART REFERENCES

A chart reference is a convenient way of reference a chart in a chart repository.

When you use a chart reference with a repo prefix (‘stable/mariadb’), Helm will look in the local configuration for a chart repository named ‘stable’, and will then look for a chart in that repository whose name is ‘mariadb’. It will install the latest version of that chart unless you also supply a version number with the ‘–version’ flag.

To see the list of chart repositories, use ‘helm repo list’. To search for charts in a repository, use ‘helm search’.

Just run istioctl dashboard kiali.

Istioctl will create a proxy. Now log in with admin/admin credentials.

To answer the second question: Istio is running on your cluster and is configure with istioctl, installed on your bastion.

By labeling a namespace with istio-injection=enabled the sidecar will be injected automatically. If necessary, you can disable the injection for a pod by annotating it like this:

I found the solution: I had to set the role kms.keys.encrypterDecrypter to the service account which is used to control Kubernetes cluster in the settings of Yandex.Cloud project catalog.

Faced a similar problem.

Fixed by update efs-csi-node daemonset from amazon/aws-efs-csi-driver:v0.3.0 image to amazon/aws-efs-csi-driver:latest

You can find out by running the following on the master node: