Using secret provider class in Kustomize

[monicabiswal147]

Hi team,

When we do the kubernetes integration with vault using CSI provider, we usually define a secret provider class(SPC) which contains all the information about the secrets present in vault which is then volume mounted on to a pod. Does Kustomize provides the support for using SPC in the secrets generator? We do not want to define the secrets again in kustomization.yaml or Is there any other way to achieve this using Kustomize?

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[annasong20]

/kind support

[annasong20]

@monicabiswal147 I don't have prior experience with vault, CSI provider, or SPCs, but from skimming https://kubernetes.io/blog/2019/01/15/container-storage-interface-ga/, it sounds like you're asking if Kustomize's secretGenerator interfaces with external providers to fetch secrets. If this is the case, no, Kustomize's secretGenerator is more rudimentary than that. It generates secrets from literals or files, at most base-64 encoding or adding labels to the generated secret, etc.

We recommend asking questions in the Kustomize Slack channel
https://kubernetes.slack.com/archives/C9A5ALABG or starting a GitHub Discussion. You're likely to get a faster response that way!