You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To use the Secrets Store CSI driver, create a `SecretProviderClass` custom resource to provide driver configurations and provider-specific parameters to the CSI driver.
128
+
129
+
A `SecretProviderClass` custom resource should have the following components:
130
+
```yaml
131
+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
132
+
kind: SecretProviderClass
133
+
metadata:
134
+
name: my-provider
135
+
spec:
136
+
provider: vault # accepted provider options: azure or vault
137
+
parameters: # provider-specific parameters
138
+
```
139
+
140
+
Here is a sample [`SecretProviderClass` custom resource](https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/master/test/bats/tests/vault_v1alpha1_secretproviderclass.yaml)
141
+
142
+
### Update your Deployment Yaml
143
+
144
+
To ensure your application is using the Secrets Store CSI driver, update your deployment yaml to use the `secrets-store.csi.k8s.io` driver and reference the `SecretProviderClass` resource created in the previous step.
145
+
146
+
```yaml
147
+
volumes:
148
+
- name: secrets-store-inline
149
+
csi:
150
+
driver: secrets-store.csi.k8s.io
151
+
readOnly: true
152
+
volumeAttributes:
153
+
secretProviderClass: "my-provider"
154
+
```
155
+
156
+
Here is a sample [deployment yaml](https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/master/test/bats/tests/nginx-pod-vault-inline-volume-secretproviderclass.yaml) using the Secrets Store CSI driver.
157
+
158
+
### Secret Content is Mounted on Pod Start
159
+
On pod start and restart, the driver will call the provider binary to retrieve the secret content from the external Secrets Store you have specified in the `SecretProviderClass` custom resource. Then the content will be mounted to the container's file system.
160
+
161
+
To validate, once the pod is started, you should see the new mounted content at the volume path specified in your deployment yaml.
162
+
163
+
```bash
164
+
kubectl exec -it nginx-secrets-store-inline ls /mnt/secrets-store/
165
+
foo
166
+
```
167
+
168
+
### [OPTIONAL] Sync with Kubernetes Secrets
169
+
170
+
In some cases, you may want to create a Kubernetes Secret to mirror the mounted content. Use the optional `secretObjects` field to define the desired state of the synced Kubernetes secret objects.
171
+
172
+
A `SecretProviderClass` custom resource should have the following components:
173
+
```yaml
174
+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
175
+
kind: SecretProviderClass
176
+
metadata:
177
+
name: my-provider
178
+
spec:
179
+
provider: vault # accepted provider options: azure or vault
180
+
parameters: # provider-specific parameters
181
+
secretObjects: # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
182
+
- data:
183
+
- key: username # data field to populate
184
+
objectName: foo1 # name of the object to sync
185
+
secretName: foosecret # name of the Kubernetes Secret object
186
+
type: Opaque # type of the Kubernetes Secret object e.g. Opaque, kubernetes.io/tls
187
+
```
188
+
> NOTE: Here is the list of [supported Kubernetes Secret types](https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/master/pkg/secrets-store/utils.go#L660-L675).
189
+
190
+
Here is a sample [`SecretProviderClass` custom resource](https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/master/test/bats/tests/vault_synck8s_v1alpha1_secretproviderclass.yaml) that syncs Kubernetes secrets.
191
+
192
+
### [OPTIONAL] Set ENV VAR
193
+
194
+
Once the secret is created, you may wish to set an ENV VAR in your deployment to reference the new Kubernetes secret.
195
+
196
+
```yaml
197
+
spec:
198
+
containers:
199
+
- image: nginx
200
+
name: nginx
201
+
env:
202
+
- name: SECRET_USERNAME
203
+
valueFrom:
204
+
secretKeyRef:
205
+
name: foosecret
206
+
key: username
207
+
```
208
+
Here is a sample [deployment yaml](https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/master/test/bats/tests/nginx-deployment-synck8s.yaml) that creates an ENV VAR from the synced Kubernetes secret.
0 commit comments