AKS集成HashiCorp Vault时External Secret遇403权限拒绝求助

我按照网上大量示例尝试将AKS集群与HashiCorp Vault集成，操作步骤看似简单，但始终无法解决External Secret的403错误，不清楚遗漏了什么配置。以下是详细操作及报错信息：

操作步骤 #

1. 创建存储Vault Token的Kubernetes Secret #

kubectl create secret generic vault-token --from-literal=xxx

2. 部署ClusterSecretStore #

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: "https://vault-public-vault-replaced.replaced.z1.hashicorp.cloud:8200"
      path: "secret"
      version: "v1"
      auth:
        tokenSecretRef:
          name: "vault-token"
          key: "token"

3. 验证ClusterSecretStore状态（显示有效） #

NAME            AGE   STATUS   CAPABILITIES   READY
vault-backend   72s   Valid    ReadWrite      True

4. 在Vault手动创建密钥 #

vault kv put -mount=secret secret key=secret-value                                                                              
=== Secret Path ===
secret/data/secret

======= Metadata =======
Key                Value
---                -----
created_time       2023-12-06T03:16:22.778004757Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            2

5. 创建ExternalSecret #

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: test-external-secret
spec:
  refreshInterval: "15s"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: test-external-secret
    creationPolicy: Owner
  data:
    - secretKey: test-external-secret-key
      remoteRef:
        key: secret/secret
        property: key

报错信息 #

ExternalSecret状态及事件：

Name:         test-external-secret
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  external-secrets.io/v1beta1
Kind:         ExternalSecret
Metadata:
  Creation Timestamp:  2023-12-06T03:19:43Z
  Generation:          1
  Managed Fields:
    API Version:  external-secrets.io/v1beta1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:data:
        f:refreshInterval:
        f:secretStoreRef:
          .:
          f:kind:
          f:name:
        f:target:
          .:
          f:creationPolicy:
          f:deletionPolicy:
          f:name:
    Manager:      kubectl-client-side-apply
    Operation:    Update
    Time:         2023-12-06T03:19:43Z
    API Version:  external-secrets.io/v1beta1
    Fields Type:  FieldsV1
    fieldsV1:
      f:status:
        .:
        f:conditions:
    Manager:         external-secrets
    Operation:       Update
    Subresource:     status
    Time:            2023-12-06T03:19:44Z
  Resource Version:  2182430
  UID:               e68cbb3f-05de-4eaf-bcf5-7cdebac52b3f
Spec:
  Data:
    Remote Ref:
      Conversion Strategy:  Default
      Decoding Strategy:    None
      Key:                  secret/secret
      Property:             key
    Secret Key:             test-external-secret-key
  Refresh Interval:         15s
  Secret Store Ref:
    Kind:  ClusterSecretStore
    Name:  vault-backend
  Target:
    Creation Policy:  Owner
    Deletion Policy:  Retain
    Name:             test-external-secret
Status:
  Conditions:
    Last Transition Time:  2023-12-06T03:19:44Z
    Message:               could not get secret data from provider
    Reason:                SecretSyncedError
    Status:                False
    Type:                  Ready
Events:
  Type     Reason        Age                   From              Message
  ----     ------        ----                  ----              -------
  Warning  UpdateFailed  66s (x16 over 3m52s)  external-secrets  cannot read secret data from Vault: Error making API request.

URL: GET https://vault-public-vault-replaced.replaced.z1.hashicorp.cloud:8200/v1/secret/secret
Code: 403. Errors:

* 1 error occurred:
  * permission denied

恳请各位提供帮助！

内容的提问来源于stack exchange，提问作者Gary Turner