Secrets Store CSI Driver: Keeping Secrets Secret
summary
Secrets Store CSI Driver installs as a node-level daemonset plus a provider daemonset and mounts secrets as tempfs files so workloads read secrets from the filesystem without code changes. It supports Azure Key Vault, Google Secret Manager and HashiCorp Vault (AWS planned) and requires Kubernetes 1.16+ (Windows 1.18+). It can syncs to Kubernetes secrets for ingress TLS and other consumers and performs automatic rotation via periodic RPCs and a file-watcher (demo shows a rotated cert updated from Apr 6 to Apr 14).
AI-written summary · about
chapters (15)
- 0:00Start
- 0:10Intro
- 1:30Consuming external secrets
- 3:14Secrets Store CSI Driver
- 3:41Features
- 4:18Requirements
- 4:28Supported Providers
- 4:40Diagram
- 6:40SecretProviderClassPodStatus
- 14:08Sync as Kubernetes Secret
- 14:53Secret Auto Rotation
- 22:43Roadmap
- 23:06Get Involved
- 23:32Resources
- 23:56Questions
related talks
36mSecrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8s
24mCan You Keep a Secret? On Secret Management in Kubernetes
30mLook Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap
39mManaging and securing Kubernetes secrets - Simon Pearce
30mHow to Make Kubernetes Secrets Really… Secret?
41mOptimizing Secrets Management
50mSecuring Secrets in Kubernetes with Secret Provider and Azure Key Vault
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter