Secrets Store CSI driver

Overview

Kubernetes secrets are stored with Base64 encoding. etcd provides encryption at rest for these secrets, but when secrets are retrieved, they are decrypted and presented to the user. If role-based access control is not configured properly on your cluster, anyone with API or etcd access can retrieve or modify a secret. Additionally, anyone who is authorized to create a pod in a namespace can use that access to read any secret in that namespace.

To store and manage your secrets securely, you can configure the OKD Secrets Store Container Storage Interface (CSI) Driver Operator to mount secrets from an external secret management system, such as Azure Key Vault, by using a provider plugin. Applications can then use the secret, but the secret does not persist on the system after the application pod is destroyed.

The Secrets Store CSI Driver Operator, secrets-store.csi.k8s.io, enables OKD to mount multiple secrets, keys, and certificates stored in enterprise-grade external secrets stores into pods as a volume. The Secrets Store CSI Driver Operator communicates with the provider using gRPC to fetch the mount contents from the specified external secrets store. After the volume is attached, the data in it is mounted into the container’s file system. Secrets store volumes are mounted in-line.

For more information about CSI inline volumes, see CSI inline ephemeral volumes.

Familiarity with persistent storage and configuring CSI volumes is recommended when working with a CSI driver.

Secrets store providers

The following secrets store providers are available for use with the Secrets Store CSI Driver Operator:

• AWS Secrets Manager

• AWS Systems Manager Parameter Store

• Azure Key Vault

About CSI

Storage vendors have traditionally provided storage drivers as part of Kubernetes. With the implementation of the Container Storage Interface (CSI), third-party providers can instead deliver storage plugins using a standard interface without ever having to change the core Kubernetes code.

CSI Operators give OKD users storage options, such as volume snapshots, that are not possible with in-tree volume plugins.

Installing the Secrets Store CSI driver

Prerequisites

• Access to the OKD web console.

• Administrator access to the cluster.

Procedure

To install the Secrets Store CSI driver:

1. Install the Secrets Store CSI Driver Operator:

   1. Log in to the web console.

   2. Click Operators → OperatorHub.

   3. Locate the Secrets Store CSI Driver Operator by typing “Secrets Store CSI” in the filter box.

   4. Click the Secrets Store CSI Driver Operator button.

   5. On the Secrets Store CSI Driver Operator page, click Install.

   6. On the Install Operator page, ensure that:

      • All namespaces on the cluster (default) is selected.

      • Installed Namespace is set to openshift-cluster-csi-drivers.

   7. Click Install.

      After the installation finishes, the Secrets Store CSI Driver Operator is listed in the Installed Operators section of the web console.

2. Create the ClusterCSIDriver instance for the driver (secrets-store.csi.k8s.io):

   1. Click Administration → CustomResourceDefinitions → ClusterCSIDriver.

   2. On the Instances tab, click Create ClusterCSIDriver.

      Use the following YAML file:

      apiVersion: operator.openshift.io/v1
      kind: ClusterCSIDriver
      metadata:
          name: secrets-store.csi.k8s.io
      spec:
        managementState: Managed

   3. Click Create.

Next steps

• Mounting secrets from an external secrets store to a CSI volume

Uninstalling the Secrets Store CSI Driver Operator

Prerequisites

• Access to the OKD web console.

• Administrator access to the cluster.

Procedure

To uninstall the Secrets Store CSI Driver Operator:

1. Stop all application pods that use the secrets-store.csi.k8s.io provider.

2. Remove any third-party provider plug-in for your chosen secret store.

3. Remove the Container Storage Interface (CSI) driver and associated manifests:

   1. Click Administration → CustomResourceDefinitions → ClusterCSIDriver.

   2. On the Instances tab, for secrets-store.csi.k8s.io, on the far left side, click the drop-down menu, and then click Delete ClusterCSIDriver.

   3. When prompted, click Delete.

4. Verify that the CSI driver pods are no longer running.

5. Uninstall the Secrets Store CSI Driver Operator:

   Before you can uninstall the Operator, you must remove the CSI driver first.

   1. Click Operators → Installed Operators.

   2. On the Installed Operators page, scroll or type “Secrets Store CSI” into the Search by name box to find the Operator, and then click it.

   3. On the upper, right of the Installed Operators > Operator details page, click Actions → Uninstall Operator.

   4. When prompted on the Uninstall Operator window, click the Uninstall button to remove the Operator from the namespace. Any applications deployed by the Operator on the cluster need to be cleaned up manually.

      After uninstalling, the Secrets Store CSI Driver Operator is no longer listed in the Installed Operators section of the web console.

Additional resources

• Configuring CSI volumes