Fixed in Secrets Store CSI driver v0.0.17 with AKV provider 0.0.10, which added checks to skip rotation and reconcile for deleting pods. Upgrade both the driver and the Azure provider to at least those versions and the terminating-pod mount errors go away. Source: https://github.com/Azure/secrets-st…
IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were de…
This is expected behavior on new nodes: pods referencing CSI volumes cannot start until the CSI driver registers on that node. During an AKS upgrade the node-driver-registrar image must be pulled onto the fresh node first, one reporter saw the pull take over 6 minutes. The recommended fixes: use the…
This happens when the managed identity is not actually enabled on the host. In the Azure portal, open the App Service, go to Identity under Settings, and make sure Status is On under the System assigned tab. Also confirm the identity has the Azure App Configuration Data Reader role on the store, wit…
Set `userAssignedIdentityID` to the client ID of the identity that has Key Vault access in your SecretProviderClass. The reporter confirmed this single change resolved the mount failure. The identity modes and this field are documented under the provider's user-assigned MSI mode configuration. Sourc…
The feature-flag naming issue behind this was fixed in the latest spring-cloud-azure-feature-management release, upgrade the library and the refresh works. One limitation confirmed by the maintainers remains: feature flags cannot currently be served from multiple App Configuration stores, since flag…
This was caused by the release of task version 10, which broke resolution of the older task versions. The Azure team removed version 10 from the marketplace to restore the previous versions. Fix: revert your pipeline back to the task version you were using before (e.g. AzureAppConfigurationPush@6), …
Pass `connection_verify=False` when creating the client: `DocumentIntelligenceClient(endpoint=..., credential=..., connection_verify=False)`. This is documented in the azure-core configuration options and was confirmed by the Azure SDK maintainer on this issue. Note the security caveat: with verific…
Fixed in Secrets Store CSI driver v0.0.17 with AKV provider 0.0.10, which added checks to skip rotation and reconcile for deleting pods. Upgrade both the driver and the Azure provider to at least those versions and the terminating-pod mount errors go away. Source: https://github.com/Azure/secrets-st…
IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were de…
This is expected behavior on new nodes: pods referencing CSI volumes cannot start until the CSI driver registers on that node. During an AKS upgrade the node-driver-registrar image must be pulled onto the fresh node first, one reporter saw the pull take over 6 minutes. The recommended fixes: use the…
This happens when the managed identity is not actually enabled on the host. In the Azure portal, open the App Service, go to Identity under Settings, and make sure Status is On under the System assigned tab. Also confirm the identity has the Azure App Configuration Data Reader role on the store, wit…
Set `userAssignedIdentityID` to the client ID of the identity that has Key Vault access in your SecretProviderClass. The reporter confirmed this single change resolved the mount failure. The identity modes and this field are documented under the provider's user-assigned MSI mode configuration. Sourc…
The feature-flag naming issue behind this was fixed in the latest spring-cloud-azure-feature-management release, upgrade the library and the refresh works. One limitation confirmed by the maintainers remains: feature flags cannot currently be served from multiple App Configuration stores, since flag…
This was caused by the release of task version 10, which broke resolution of the older task versions. The Azure team removed version 10 from the marketplace to restore the previous versions. Fix: revert your pipeline back to the task version you were using before (e.g. AzureAppConfigurationPush@6), …
Pass `connection_verify=False` when creating the client: `DocumentIntelligenceClient(endpoint=..., credential=..., connection_verify=False)`. This is documented in the azure-core configuration options and was confirmed by the Azure SDK maintainer on this issue. Note the security caveat: with verific…