secrets-store-csi-driver-provider-infisical

README

secrets-store-csi-driver-provider-infisical

Unofficial Infisical provider for the Secret Store CSI Driver.

Install

1. Prepare a Kubernetes Cluser running Secret Store SCI Driver
2. Install Infisical secret proivder
   • If you can use HELM:

     helm repo add secrets-store-csi-driver-provider-infisical https://raw.githubusercontent.com/gidoichi/secrets-store-csi-driver-provider-infisical/main/charts
     helm install secrets-store-csi-driver-provider-infisical secrets-store-csi-driver-provider-infisical/secrets-store-csi-driver-provider-infisical
     

   • If you want to use kubectl (Using HELM is recommended, as some features are excluded from ./deployment):

     kubectl apply -f ./deployment/infisical-csi-provider.yaml
     

Usage

1. Create a new Infisical client using Universal Auth
2. Store the Client ID and the Client Secret to a Kubernetes Secret as client-id key and client-secret key respectively

   # You can create a secret using the following command or applying `./examples/secret.yaml` after it is edited
   kubectl create secret generic infisical-secret-provider-auth-credentials --from-literal="client-id=$id" --from-literal="client-secret=$secret"
   

3. Create an SecretProviderClass referencing the secret

   # You should edit secretproviderclass.yaml to get secrets from provider
   kubectl apply -f ./examples/secretproviderclass.yaml
   

4. Create an Pod using the SecretProviderClass

   # This deployment lists and reads all secrets, then output logs of their contents
   kubectl apply -f ./examples/deployment.yaml
   

Supported Features

Some features are not supported by this provider. Please refer to this link for the list of features supported by the Secret Store CSI Driver.

Features	Supported
Sync as Kubernetes Secret	Yes
Rotation	No
Windows	No
Helm Chart	Yes

Test

The following are tested scenarios as part of CI. More detailed descriptions of these scenarios are available here.

Test Category	Status
Mount tests
Sync as Kubernetes secrets
Namespaced Scope SecretProviderClass
Namespaced Scope SecretProviderClass negative test
Multiple SecretProviderClass
Autorotation of mount contents and Kubernetes secrets
Test filtered watch for nodePublishSecretRef feature
Windows tests