We are updating the 1Password Community between 9:30am ET and 10:30am ET on June 24th. The web experience may be impacted during this time.

Forum Discussion

Gemberkoekje's avatar
Gemberkoekje
New Contributor
22 days ago

Using 1password Injection with Service Account on FLUX Kubernetes

I'd like to request some assistance figuring out what's wrong with my setup.

I have 3 refurbished PC's I revived as a K3S Kubernetes cluster.

I have added FLUX, so I can re-apply the same set of configurations each time if I so desire.

Relevant is the following: I am making a Discord Bot, and as I would like to keep the relevant Discord Token a secret, I'd like to use 1password secret injection for that.

I followed the 7 steps as outlined here (https://github.com/1Password/kubernetes-secrets-injector) for using a service account. I also have a service account, vault, and appropriate 1password token safely stored in my cluster.

```
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: external-secrets
  namespace: flux-system
spec:
  url: https://charts.external-secrets.io
  interval: 1h
```

```
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: onepassword-secrets-injector
  namespace: flux-system
spec:
  interval: 10m
  chart:
    spec:
      chart: secrets-injector
      version: "1.1.0" # or latest stable
      sourceRef:
        kind: HelmRepository
        name: onepassword
        namespace: flux-system
  values: {}
```

```
apiVersion: apps/v1
kind: Deployment
metadata:
  name: botcs
  namespace: botcs
spec:
  replicas: 2
  selector:
    matchLabels:
      app: botcs
  template:
    metadata:
      labels:
        app: botcs
        secrets-injection: enabled
      annotations:
        operator.1password.io/inject: "botcs"
        operator.1password.io/version: "2-beta"
    spec:
      containers:
        - name: botcs
          image: ghcr.io/[mygithub]/botcs:1.0.0-37
          command: ["dotnet", BotCs.dll"]
          ports:
            - containerPort: 8080
          resources:
            limits:
              memory: "512Mi"
              cpu: "500m"
            requests:
              memory: "256Mi"
              cpu: "250m"
          env:
            - name: OP_SERVICE_ACCOUNT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: op-service-account
                  key: token
            - name: Discord__Token
              value: op://[My1PasswordVault]/discord-secret/token
            - name: ConnectionStrings__Postgres
              value: op://[My1PasswordVault]/postgress-secret/connectionstring
```

The issue I'm running into is that I'm getting the following error on deployment. Not even on the pod itself, on the deployment step:

```
Error creating: Internal error occurred: failed calling webhook "secrets-injector.1password.com": failed to call webhook: Post "https://secrets-injector.flux-system.svc:443/inject?timeout=10s": proxy error from 127.0.0.1:6443 while dialing 10.42.1.86:8443, code 502: 502 Bad Gateway
```

I have checked everything, the pod is running, the mutatingwebhook is running, nothing is giving any errors other than the deployment of the bot pod, and I'm getting at my wit's end what is causing this issue. Even if you'd be able to send me in the right direction where to look, that might already be all I need right now.

Any help would be appreciated.

No RepliesBe the first to reply