1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["11343"],{55082(e,n,s){s.r(n),s.d(n,{metadata:()=>r,default:()=>p,frontMatter:()=>i,contentTitle:()=>a,toc:()=>d,assets:()=>c});var r=JSON.parse('{"id":"platform/k8s/csi/index","title":"OpenBao CSI provider","description":"The OpenBao CSI Provider allows pods to consume OpenBao secrets using CSI volumes.","source":"@site/versioned_docs/version-2.5.x/platform/k8s/csi/index.mdx","sourceDirName":"platform/k8s/csi","slug":"/platform/k8s/csi/","permalink":"/docs/2.5.x/platform/k8s/csi/","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/blob/release/2.5.x/website/content/docs/platform/k8s/csi/index.mdx","tags":[],"version":"2.5.x","frontMatter":{"sidebar_label":"Overview","description":"The OpenBao CSI Provider allows pods to consume OpenBao secrets using CSI volumes."},"sidebar":"docs","previous":{"title":"Snapshot Cronjob Example","permalink":"/docs/2.5.x/platform/k8s/helm/examples/snapshot-cronjob"},"next":{"title":"Installation","permalink":"/docs/2.5.x/platform/k8s/csi/installation"}}'),t=s(94686),o=s(44812);let i={sidebar_label:"Overview",description:"The OpenBao CSI Provider allows pods to consume OpenBao secrets using CSI volumes."},a="OpenBao CSI provider",c={},d=[{value:"Overview",id:"overview",level:2},{value:"Features",id:"features",level:3},{value:"Supported kubernetes versions",id:"supported-kubernetes-versions",level:2},{value:"Authenticating with OpenBao",id:"authenticating-with-openbao",level:2},{value:"Secret provider class example",id:"secret-provider-class-example",level:2},{value:"Using secret provider classes",id:"using-secret-provider-classes",level:2}];function l(e){let n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.header,{children:(0,t.jsx)(n.h1,{id:"openbao-csi-provider",children:"OpenBao CSI provider"})}),"\n",(0,t.jsxs)(n.p,{children:["The OpenBao CSI Provider allows pods to consume OpenBao secrets using\n",(0,t.jsx)(n.a,{href:"https://github.com/kubernetes-sigs/secrets-store-csi-driver",children:"CSI Secrets Store"})," volumes."]}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:["The OpenBao CSI Provider requires the ",(0,t.jsx)(n.a,{href:"https://github.com/kubernetes-sigs/secrets-store-csi-driver",children:"CSI Secret Store"}),"\nDriver to be installed."]})}),"\n",(0,t.jsx)(n.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(n.p,{children:["At a high level, the CSI Secrets Store driver allows users to create ",(0,t.jsx)(n.code,{children:"SecretProviderClass"})," objects.\nThis object defines which secret provider to use and what secrets to retrieve. When pods requesting CSI volumes\nare created, the CSI Secrets Store driver will send the request to the OpenBao CSI Provider if the provider\nis ",(0,t.jsx)(n.code,{children:"openbao"}),". The OpenBao CSI Provider will then use Secret Provider Class specified and the pod's service account to retrieve\nthe secrets from OpenBao, and mount them into the pod's CSI volume."]}),"\n",(0,t.jsxs)(n.p,{children:["The secret is retrieved from OpenBao and populated to the CSI secrets store volume during the ",(0,t.jsx)(n.code,{children:"ContainerCreation"})," phase.\nThis means that pods will be blocked from starting until the secrets have been read from OpenBao and written to the volume."]}),"\n",(0,t.jsx)(n.h3,{id:"features",children:"Features"}),"\n",(0,t.jsx)(n.p,{children:"The following features are supported by the OpenBao CSI Provider:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"All OpenBao secret engines supported."}),"\n",(0,t.jsx)(n.li,{children:"Authentication using the requesting pod's service account."}),"\n",(0,t.jsx)(n.li,{children:"TLS/mTLS communications with OpenBao."}),"\n",(0,t.jsx)(n.li,{children:"Rendering OpenBao secrets to files."}),"\n",(0,t.jsx)(n.li,{children:"Dynamic lease caching and renewal performed by Agent."}),"\n",(0,t.jsx)(n.li,{children:"Syncing secrets to Kubernetes secrets to be used as environment variables."}),"\n",(0,t.jsxs)(n.li,{children:["Installation via ",(0,t.jsx)(n.a,{href:"/docs/2.5.x/platform/k8s/helm/",children:"OpenBao Helm"})]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"supported-kubernetes-versions",children:"Supported kubernetes versions"}),"\n",(0,t.jsxs)(n.p,{children:["In line with the Kubernetes project, we support and run tests against the three\nmost recent ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/releases/",children:"Kubernetes minor releases"}),". It may work with\nother versions of Kubernetes, but those are not supported or tested against."]}),"\n",(0,t.jsx)(n.h2,{id:"authenticating-with-openbao",children:"Authenticating with OpenBao"}),"\n",(0,t.jsxs)(n.p,{children:["The OpenBao CSI Provider will authenticate with OpenBao as the service account of the\npod that mounts the CSI volume. ",(0,t.jsx)(n.a,{href:"/docs/2.5.x/auth/kubernetes",children:"Kubernetes"})," and\n",(0,t.jsx)(n.a,{href:"/docs/2.5.x/auth/jwt/",children:"JWT"})," auth methods are supported. The pod's service account\nmust be bound to a OpenBao role and a policy granting access to the secrets desired."]}),"\n",(0,t.jsx)(n.p,{children:"It is highly recommended to run pods with dedicated Kubernetes service accounts to\nensure applications cannot access more secrets than they require."}),"\n",(0,t.jsx)(n.h2,{id:"secret-provider-class-example",children:"Secret provider class example"}),"\n",(0,t.jsxs)(n.p,{children:["The following is an example of a Secret Provider Class using the ",(0,t.jsx)(n.code,{children:"openbao"})," provider:"]}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.code,{children:"provider: openbao"})," only works starting with the OpenBao Helm Chart version 0.18.0, which uses the OpenBao CSI Provider version 2.0.0 or later."]})}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-yaml",children:'---\napiVersion: secrets-store.csi.x-k8
1s.io/v1alpha1\nkind: SecretProviderClass\nmetadata:\n name: openbao-db-creds\nspec:\n # OpenBao CSI Provider\n provider: openbao\n parameters:\n # OpenBao role name to use during login\n roleName: \'app\'\n # OpenBao address and TLS connection config is normally best configured by the\n # helm chart, but can be overridden per SecretProviderClass:\n # OpenBao\'s hostname\n baoAddress: \'https://openbao:8200\'\n # TLS CA certification for validation\n baoCACertPath: \'/openbao/tls/ca.crt\'\n objects: |\n - objectName: "dbUsername"\n secretPath: "database/creds/db-app"\n secretKey: "username"\n - objectName: "dbPassword"\n secretPath: "database/creds/db-app"\n secretKey: "password"\n # "objectName" is an alias used within the SecretProviderClass to reference\n # that specific secret. This will also be the filename containing the secret.\n # "secretPath" is the path in OpenBao where the secret should be retrieved.\n # "secretKey" is the key within the OpenBao secret response to extract a value from.\n'})}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsx)(n.p,{children:"Secret Provider Class is a namespaced object in Kubernetes."})}),"\n",(0,t.jsx)(n.h2,{id:"using-secret-provider-classes",children:"Using secret provider classes"}),"\n",(0,t.jsx)(n.p,{children:"An application pod uses the example Secret Provider Class above by mounting it as a CSI volume:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-yaml",children:"---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: app\n labels:\n app: demo\nspec:\n selector:\n matchLabels:\n app: demo\n replicas: 1\n template:\n spec:\n serviceAccountName: app\n containers:\n - name: app\n image: my-app:1.0.0\n volumeMounts:\n - name: 'openbao-db-creds'\n mountPath: '/mnt/secrets-store'\n readOnly: true\n volumes:\n - name: openbao-db-creds\n csi:\n driver: 'secrets-store.csi.k8s.io'\n readOnly: true\n volumeAttributes:\n secretProviderClass: 'openbao-db-creds'\n"})}),"\n",(0,t.jsxs)(n.p,{children:["In this example ",(0,t.jsx)(n.code,{children:"volumes.csi"})," is created on the application deployment and references\nthe Secret Provider Class named ",(0,t.jsx)(n.code,{children:"openbao-db-creds"}),"."]})]})}function p(e={}){let{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},44812(e,n,s){s.d(n,{R:()=>i,x:()=>a});var r=s(92990);let t={},o=r.createContext(t);function i(e){let n=r.useContext(o);return r.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),r.createElement(o.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.