Secrets Store CSI Driver addonNew#

Important

Before you can use the Secrets Store CSI Driver addon, you must first install a compatible provider-specific plugin on your MKE 4 cluster, to communicate with the target Secret management system. Refer to the official Secret Store CSI Driver documentation for a list of the supported Secrets providers.
Secrets providers are installed separately and are not managed by MKE 4.
The Secret Store CSI Driver addon does not support Windows nodes, and as such you should explicitly disable these nodes in your MKE 4 configuration.

With the Secrets Store CSI Driver addon you can integrate the Kubernetes Secrets Store CSI Driver into MKE 4 as a managed service. Once enabled, this addon provides a unified interface through which MKE 4 retrieves Secrets from supported external providers, allowing Pods to mount them directly as volumes, without having to store them as Kubernetes Secrets.

Install a Secrets provider#

The Secrets Store CSI Driver addon is disabled by default.

Configure a Secrets provider as a backend that to supply the Secrets.
Create a SecretProviderClass resource that maps external Secrets to mount paths from your chosen Secrets provider, then reference it in your Pod specification. For details, refer to the official Secrets Store CSI Driver documentation.

Enable the Secrets Store CSI Driver#

Obtain the default mke4.yaml configuration file:
```
mkectl init
```
In the mke4.yaml configuration file, set the spec.secretsStoreCSIDriver.enabled parameter to true:
```
spec:
  secretsStoreCSIDriver:
    enabled: true
```
Apply the configuration:
```
mkectl apply -f mke4.yaml
```

Sync Secrets to Kubernetes Secret objects#

By default, mounted Secrets are only accessible as files inside the Pod. You can, though, make them available as Kubernetes Secret objects as well, for use as environment variables or by other workloads.

Obtain the default mke4.yaml configuration file:
```
mkectl init
```
In the mke4.yaml configuration file, set the spec.secretsStoreCSIDriver.syncSecret parameter to true:
```
spec:
  secretsStoreCSIDriver:
    enabled: true
    syncSecret: true
```
Note

When syncSecret is enabled, the driver installs additional RBAC roles and bindings. Review the granted permissions before you enable the feature in production.
Apply the configuration:
```
mkectl apply -f mke4.yaml
```

Configuration parameters#

Parameter	Type	Description
`enabled`	bool	Enable or disable the Secrets Store CSI Driver addon. Default: `false`
`maxCallRecvMsgSize`	integer	Maximum size in bytes of a gRPC response from a provider plugin. Default: `4194304`
`syncSecret`	bool	When `true`, causes the installation of the RBAC roles and bindings that are required to sync Secrets from the external store into Kubernetes `Secret` objects. Default: `false`
`automountServiceAccountToken`	bool	Controls whether a service account token is automatically mounted on the driver pod. Default: `true`
`tokenRequests[].audience`	string	Audience for the service account token used by the driver to impersonate Pods. Requires Kubernetes v1.20 or later.
`tokenRequests[].expirationSeconds`	integer	Expiration time in seconds for the service account token.
`linux.enabled`	bool	Deploy the driver `DaemonSet` on Linux nodes. Default: `true`
`linux.nodeSelector`	map	Node selector labels for scheduling driver Pods on Linux nodes. Default: `{}`
`linux.metricsAddr`	string	Address on which the driver exposes metrics, for example `:8095`. Default: `""`
`linux.priorityClassName`	string	Priority class for Linux driver Pods. Default: `""`
`linux.providersDir`	string	Root directory on the host where the provider sockets are located. Default: `""`
`linux.additionalProvidersDirs`	list	Additional host directories that contain provider sockets. Default: `[]`
`windows.enabled`	bool	Must be set to false, until Windows nodes will be supported. Default: `false`

Notes

The structure of the configuration parameters is mirrored from official helm chart for the Secrets Store CSI Driver.
The driver configuration is split into separate sections for Linux and Windows to allow for different settings on each OS. For example, you may choose to deploy the driver only on Linux nodes by enabling the Linux section and leaving the Windows section disabled. (see details below).
Windows nodes are not supported, and as such they should be explicitly disabled.

Full configuration example:

spec:
  secretsStoreCSIDriver:
    enabled: true
    maxCallRecvMsgSize: 4194304
    syncSecret: true
    automountServiceAccountToken: true
    tokenRequests:
      - audience: "vault"
        expirationSeconds: 3600

    linux:
      enabled: true
      nodeSelector:
        kubernetes.io/os: linux
      metricsAddr: ":8095"
      priorityClassName: "system-cluster-critical"
      providersDir: "/var/run/secrets-store-csi-providers"
      additionalProvidersDirs:
        - "/var/run/secrets-store-csi-providers-custom"

    windows:
      enabled: false