Skip to content

Commit a7149f0

Browse files
lpettyjolpettyjo
authored
Merge pull request #60607 from lpettyjo/OSDOCS-5785
OSDOCS-5785#Secret Store CSI operator (TP)
2 parents b099927 + 74d6409 commit a7149f0

6 files changed

+135
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1604,6 +1604,8 @@ Topics:
16041604
File: persistent-storage-csi-cinder
16051605
- Name: OpenStack Manila CSI Driver Operator
16061606
File: persistent-storage-csi-manila
1607+
- Name: Secrets Store CSI Driver Operator
1608+
File: persistent-storage-csi-secrets-store
16071609
- Name: VMware vSphere CSI Driver Operator
16081610
File: persistent-storage-csi-vsphere
16091611
- Name: Generic ephemeral volumes

‎modules/persistent-storage-csi-secrets-store-driver-install.adoc

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent-storage-csi-secrets-store.adoc
4+
//
5+
6+
:_content-type: PROCEDURE
7+
[id="persistent-storage-csi-secrets-store-driver-install_{context}"]
8+
= Installing the Secrets Store CSI Driver
9+
10+
.Prerequisites
11+
* Access to the {product-title} web console.
12+
13+
* Administrator access to the cluster.
14+
15+
.Procedure
16+
17+
To install the Secrets Store CSI Driver:
18+
19+
. Install the Secrets Store Container Storage Interface (CSI) driver operator:
20+
.. Log in to the web console.
21+
.. Click *Operators* → *OperatorHub*.
22+
.. Locate the Secrets Store CSI Operator by typing "Secrets Store CSI" in the filter box.
23+
.. Click the *Secrets Store CSI Driver Operator* button.
24+
.. On the *Secrets Store CSI Driver Operator* page, click *Install*.
25+
.. On the *Install Operator* page, ensure that:
26+
+
27+
* *All namespaces on the cluster (default)* is selected.
28+
29+
* *Installed Namespace* is set to *openshift-cluster-csi-drivers*.
30+
.. Click *Install*.
31+
+
32+
After the installation finishes, the Secrets Store CSI Operator is listed in the *Installed Operators* section of the web console.
33+
34+
. Create the `ClusterCSIDriver` instance for the driver (`secrets-store.csi.k8s.io`):
35+
.. Click *Administration* -> *CustomResourceDefinitions* -> *ClusterCSIDriver*.
36+
.. On the *Instances* tab, click *Create ClusterCSIDriver*.
37+
+
38+
Use the following YAML file:
39+
+
40+
[source,yaml]
41+
----
42+
apiVersion: operator.openshift.io/v1
43+
kind: ClusterCSIDriver
44+
metadata:
45+
name: secrets-store.csi.k8s.io
46+
spec:
47+
managementState: Managed
48+
----
49+
.. Click *Create*.
50+
51+
. Install a third-party provider plugin for your chosen secret store.
52+
// TODO: Add link authentication content//

‎modules/persistent-storage-csi-secrets-store-driver-overview.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent-storage-csi-secrets-store.adoc
4+
//
5+
6+
:_content-type: CONCEPT
7+
[id="persistent-storage-csi-secrets-store-driver-overview_{context}"]
8+
= Overview
9+
10+
Kubernetes secrets are stored with Base64 encoding. etcd provides encryption at rest for these secrets, but when secrets are retrieved, they are decrypted and presented to the user. If role-based access control is not configured properly on your cluster, anyone with API or etcd access can retrieve or modify a secret. Additionally, anyone who is authorized to create a pod in a namespace can use that access to read any secret in that namespace.
11+
12+
For secure storage and management of your secrets, the {product-title} Secrets Store Container Storage Interface (CSI) Driver Operator allows you to mount secrets from an external secret management system, such as Azure Key Vault using a provider plugin. Applications can use the secret, but the secret does not persist on the system after the application pod is destroyed.
13+
14+
The Secrets Store CSI Driver Operator, `secrets-store.csi.k8s.io`, allows {product-title} to mount multiple secrets, keys, and certificates stored in enterprise-grade external secrets stores into pods as a volume. The Secrets Store CSI Driver Operator communicates with the provider using gRPC to fetch the mount contents from the specified external secrets store. After the volume is attached, the data in it is mounted into the container's file system. Secrets store volumes are mounted in-line.

‎modules/persistent-storage-csi-secrets-store-driver-uninstall.adoc

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent-storage-csi-secrets-store.adoc
4+
//
5+
6+
:_content-type: PROCEDURE
7+
[id="persistent-storage-csi-secrets-store-driver-uninstall_{context}"]
8+
= Uninstalling the Secrets Store CSI Driver Operator
9+
10+
.Prerequisites
11+
* Access to the {product-title} web console.
12+
13+
* Administrator access to the cluster.
14+
15+
.Procedure
16+
17+
To uninstall the Secrets Store CSI Driver Operator:
18+
19+
. Stop all application pods that use the `secrets-store.csi.k8s.io` provider.
20+
. Remove any third-party provider plug-in for your chosen secret store.
21+
. Remove the Container Storage Interface (CSI) driver and associated manifests:
22+
.. Click *Administration* → *CustomResourceDefinitions* → *ClusterCSIDriver*.
23+
.. On the *Instances* tab, for *secrets-store.csi.k8s.io*, on the far left side, click the drop-down menu, and then click *Delete ClusterCSIDriver*.
24+
.. When prompted, click *Delete*.
25+
. Verify that the CSI driver pods are no longer running.
26+
. Uninstall the Secrets Store CSI Driver Operator:
27+
+
28+
[NOTE]
29+
====
30+
Before you can uninstall the Operator, you must remove the CSI driver first.
31+
====
32+
+
33+
.. Click *Operators* → *Installed Operators*.
34+
.. On the *Installed Operators* page, scroll or type Secrets Store CSI into the *Search by name* box to find the Operator, and then click it.
35+
.. On the upper, right of the *Installed Operators* > *Operator details* page, click *Actions* → *Uninstall Operator*.
36+
.. When prompted on the *Uninstall Operator* window, click the *Uninstall* button to remove the Operator from the namespace. Any applications deployed by the Operator on the cluster need to be cleaned up manually.
37+
+
38+
After uninstalling, the Secrets Store CSI Driver Operator is no longer listed in the *Installed Operators* section of the web console.

‎storage/container_storage_interface/ephemeral-storage-csi-inline.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@ toc::[]
1111
Container Storage Interface (CSI) inline ephemeral volumes allow you to define a `Pod` spec that creates inline ephemeral volumes when a pod is deployed and delete them when a pod is destroyed.
1212

1313
This feature is only available with supported Container Storage Interface (CSI) drivers:
14+
1415
* Shared Resource CSI driver
1516
* Azure File CSI driver
17+
* Secrets Store CSI driver
1618
1719
include::modules/ephemeral-storage-csi-inline-overview.adoc[leveloffset=+1]
1820

‎storage/container_storage_interface/persistent-storage-csi-secrets-store.adoc

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
[id="persistent-storage-csi-secrets-store"]
2+
= Secrets Store CSI Driver
3+
include::_attributes/common-attributes.adoc[]
4+
:context: persistent-storage-csi-secrets-store
5+
6+
toc::[]
7+
8+
include::modules/persistent-storage-csi-secrets-store-driver-overview.adoc[leveloffset=+1]
9+
10+
For more information about CSI inline volumes, see xref:../../storage/container_storage_interface/ephemeral-storage-csi-inline.adoc#ephemeral-storage-csi-inline[CSI inline ephemeral volumes].
11+
12+
:FeatureName: Secrets Store CSI Driver Operator
13+
include::snippets/technology-preview.adoc[leveloffset=+1]
14+
15+
//TODO Add module for supported providers dules/secrets-store-providers.adoc
16+
17+
Familiarity with xref:../../storage/understanding-persistent-storage.adoc#understanding-persistent-storage[persistent storage] and xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-csi[configuring CSI volumes] is recommended when working with a CSI driver.
18+
19+
include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
20+
21+
include::modules/persistent-storage-csi-secrets-store-driver-install.adoc[leveloffset=+1]
22+
23+
include::modules/persistent-storage-csi-secrets-store-driver-uninstall.adoc[leveloffset=+1]
24+
25+
[role="_additional-resources"]
26+
== Additional resources
27+
* xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-csi[Configuring CSI volumes]

0 commit comments

Comments
 (0)