secrets-store-csi-driver

Secrets Store CSI Driver

Chainguard's redistribution of the Secrets Store CSI Driver Helm chart, pre-configured with hardened Chainguard Images.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace kube-system

Installation

helm install csi-secrets-store oci://cgr.dev/ORGANIZATION/charts/secrets-store-csi-driver \
  --namespace kube-system \
  --set imagePullSecrets[0].name=cgr-pull-secret

A FIPS variant of the chart, configured with the -fips Chainguard Images, is also available:

helm install csi-secrets-store oci://cgr.dev/ORGANIZATION/charts/secrets-store-csi-driver-fips \
  --namespace kube-system \
  --set imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream Secrets Store CSI Driver Helm chart. The driver integrates external secrets stores with Kubernetes via a CSI volume, and installs the SecretProviderClass and SecretProviderClassPodStatus custom resources. A provider (for example the AWS, Azure, or Vault provider) must be installed separately to fetch secrets from a backing store. All upstream configuration options and documentation apply.

For full documentation, see: https://secrets-store-csi-driver.sigs.k8s.io/