search

kubernetes-sigs / secrets-store-csi-driver

Secrets Store CSI driver for Kubernetes secrets - Integrates secrets stores with Kubernetes via a CSI volume.
https://secrets-store-csi-driver.sigs.k8s.io/
Apache License 2.0
1.25k stars 290 forks source link

Don't rely on pod creation to mount to Kubernetes secrets #298

Open djj0809 opened 4 years ago

djj0809 commented 4 years ago

Describe the solution you'd like

Currently, when you choose to sync to Kubernetes secrets, pulling secrets/certs/keys from Key vault always happen on pod creation and you also need to mount SecretProviderClass to specific pod to make it work.

If we have issues with Key Vault access (managed identity is not working, things are deleted accidently in Key Vault or Key Vault API is unavailable), things will start to fail when pod gets restart/recreated. And it's even worse for cronjobs, it will try to retrieve secrets/certs/keys from Key Vault every time a new pod is created under this cronjob, but as Key Vault is down, you can no longer create ANY new pod in production.

I hope this library can simply sync secrets/certs/keys to Kubernetes secrets at deploy time and don't need to rely on any pod to mount them, thus I don't have to worry about Key Vault availability after deployment.

Anything else you would like to add: [Miscellaneous information that will assist in solving the issue.]

Environment:

mustaFAB53 commented 2 months ago

+1

maxbeaudoin commented 1 month ago

+1

MostefaKamalLala commented 2 weeks ago

This should be the default behaviour...! +1000

kamimanzoor commented 2 weeks ago

+1 Would be great to have this feature. There are many usecases where one needs secret without mounts. For instance, we are currently implementing istio and gateway requires tls secrets. Even the official document from MS is showing to have a dummy pod to mount secret which does not really make much sense.