diff --git a/docs/integrations/platforms/kubernetes-csi.mdx b/docs/integrations/platforms/kubernetes-csi.mdx index 08f4ae237..05b981bbd 100644 --- a/docs/integrations/platforms/kubernetes-csi.mdx +++ b/docs/integrations/platforms/kubernetes-csi.mdx @@ -6,7 +6,7 @@ description: "How to use Infisical to inject secrets directly into Kubernetes po ## Overview The Infisical CSI provider allows you to use Infisical with the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io) to inject secrets directly into your Kubernetes pods through a volume mount. -In contrast to the [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes), the Infisical CSI provider will allow you to sync Infisical secrets directly to pods, removing the need for Kubernetes secret resources. +In contrast to the [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes), the Infisical CSI provider will allow you to sync Infisical secrets directly to pods as files, removing the need for Kubernetes secret resources. ```mermaid flowchart LR @@ -28,7 +28,7 @@ The following features are supported by the Infisical CSI Provider: - Integration with Secrets Store CSI Driver for direct pod mounting - Authentication using Kubernetes service accounts via machine identities -- Secret rotation and auto-syncing when enabled via CSI Driver +- Auto-syncing secrets when enabled via CSI Driver - Configurable secret paths and file mounting locations - Installation via Helm @@ -68,12 +68,12 @@ The flags configure the following: - `syncSecret.enabled=true`: Enables syncing secrets to Kubernetes secrets - If you do not wish to use the secret rotation feature of the secrets store CSI + If you do not wish to use the auto-syncing feature of the secrets store CSI driver, you can omit the `enableSecretRotation` and the `rotationPollInterval` flags. Do note that by default, secrets from Infisical are only fetched and mounted during pod creation. If there are any changes made to the secrets in - Infisical, they will not propagate to the pods unless secret rotation is - enabled for the CSI driver. + Infisical, they will not propagate to the pods unless auto-syncing is enabled + for the CSI driver. ### Install Infisical CSI Provider @@ -115,7 +115,7 @@ You can refer to the documentation for setting it up [here](https://infisical.co ### Creating Secret Provider Class With the Secrets Store CSI driver and the Infisical CSI provider installed, create a Kubernetes [SecretProviderClass](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#secretproviderclass) resource to establish -the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as much Secret Provider Classes as needed for your cluster. +the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as many Secret Provider Classes as needed for your cluster. ```yaml apiVersion: secrets-store.csi.x-k8s.io/v1 @@ -126,6 +126,7 @@ spec: provider: infisical parameters: infisicalUrl: "https://app.infisical.com" + authMethod: "kubernetes" identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3" projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36" envSlug: "prod" @@ -157,6 +158,11 @@ spec: this should be omitted. + + The auth method to use for authenticating the Infisical CSI provider with + Infisical. For now, the only supported method is `kubernetes`. + + The ID of the machine identity to use for authenticating the Infisical CSI provider with your Infisical organization. This should be the machine identity @@ -249,3 +255,26 @@ kubectl logs csi-secrets-store-csi-driver-7h4jp -n=kube-system ## Best Practices For additional guidance on setting this up for your production cluster, you can refer to the Secrets Store CSI driver documentation [here](https://secrets-store-csi-driver.sigs.k8s.io/topics/best-practices). + +## Frequently Asked Questions + + + + Yes, you can use secrets as environment variables in your pods. This requires two steps: + + 1. Enable syncing to Kubernetes secrets using `syncSecret.enabled=true` in the CSI driver configuration. + 2. Configure your pod to use these synced Kubernetes secrets as environment variables. + +You can find detailed examples in the [Secrets Store CSI driver documentation](https://secrets-store-csi-driver.sigs.k8s.io/topics/set-as-env-var). + + + + + + + Yes, you will need to explicitly list each secret you want to sync in the + Secret Provider Class configuration. This is a common requirement across all + CSI providers as the Secrets Store CSI Driver architecture requires specific + mapping of secrets to their mounted file locations. + +