Configure Azure Key Vault Provider for Secrets Store CSI Driver volumes as single volume

Question

I am using https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver to configure multiple microservices to each connect KeyVault to fetch secret. Configuring each volume causes following lines to duplicate to each microservice configuration

 volumes:
    - name: secrets-store01-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "azure-sync"

Is it possible to configure volume only once (eg persistentVolumeClaim ?) and refer to that in configuration instead of duplicating volume?

Answer 1

Hi Timo Holm,

The addon Secrets Store CSI Driver is ephemeral and ephemeral volumes are specified inline in the Pod spec, so I don't think this will work.

Also, you only need to create secretProviderclass once and use it in your deployments.

But you can try to edit the secret csi driver to persistent ( not recommended and no guarantee to work) and try to create pv and pvc for your secrets, you can refer to these files ( pv-secrets-store-csi.yaml ,pvc-secrets-store-csi-static.yaml , nginx-pod-secrets-store-pvc.yaml ).

Hope this helps, and please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.