# Vault with csi-provider

**URL:** <https://discuss.hashicorp.com/t/vault-with-csi-provider/39895>\
**Category:** Vault\
**Created:** [May 24, 2022, 4:28am UTC](https://discuss.hashicorp.com/t/vault-with-csi-provider/39895 "2022-05-24T04:28:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shishirsub10](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shishirsub10/32/28315_2.png) [@shishirsub10](https://discuss.hashicorp.com/u/shishirsub10)\
**Post date:** [May 24, 2022, 4:28am UTC](https://discuss.hashicorp.com/t/vault-with-csi-provider/39895/1 "2022-05-24T04:28:10Z")

</div>

I have installed vault as STS with csi driver enabled as I needed to inject the secrets as environment variables and it is working fine.

In the process of testing different scenarios, I deleted the vault-0 pod and after it was up, I noticed 403 error(authentication failed) from the vault api server. I updated the authentication config with the newly generated serviceaccount token and it worked fine afterwards.

```auto
vault write auth/kubernetes/config \
     issuer="https://kubernetes.default.svc.cluster.local" \
     token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
     kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
     kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

```

So my question is how to automate this? Does kubernetes has a TTL for serviceaccount tokens? Can I set this to longer period? Can I use some static servicetoken for just vault?

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [May 24, 2022, 6:22am UTC](https://discuss.hashicorp.com/t/vault-with-csi-provider/39895/2 "2022-05-24T06:22:33Z")

</div>

If you want Vault to authenticate using the service account from its own pod, you should just leave out the `token_reviewer_jwt` and `kubernetes_ca_cert` options entirely, and it will load the values provided by Kubernetes automatically:

> **[Kubernetes - Auth Methods - HTTP API | Vault by HashiCorp](https://www.vaultproject.io/api-docs/auth/kubernetes#configure-method)**
>
> This is the API documentation for the Vault Kubernetes auth method plugin.

You should also remove the deprecated `issuer` parameter.

---

<div class="post-metadata">

**Author:** ![shishirsub10](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/shishirsub10/32/28315_2.png) [@shishirsub10](https://discuss.hashicorp.com/u/shishirsub10)\
**Post date:** [May 24, 2022, 7:39am UTC](https://discuss.hashicorp.com/t/vault-with-csi-provider/39895/3 "2022-05-24T07:39:54Z")

</div>

Thank you for your answer. I have noticed that the token does not change and have included token from the secrets and wrote to `auth/kubernetes/config` and it is working now. I don’t know why it was not working earlier.

Anyway huge thanks for your help!!!