Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: add note about azure provider for secrets-store-csi-driver #560

Merged
merged 1 commit into from
Apr 27, 2023
Merged

docs: add note about azure provider for secrets-store-csi-driver #560

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion book/src/token-requests.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ volumes for. This improves the security posture in the mounting process where
the volumes are ACL’ed on the pods’ service account without handing out
unnecessary permissions to the CSI drivers’ service account.
This feature is especially important for secret-handling CSI drivers, such as
the secrets-store-csi-driver. Since these tokens can be rotated and short-lived,
the [secrets-store-csi-driver](https://github.com/kubernetes-sigs/secrets-store-csi-driver).
Since these tokens can be rotated and short-lived,
this feature also provides a knob for CSI drivers to receive NodePublishVolume
RPC calls periodically with the new token. This knob is also useful when volumes
are short-lived, e.g. certificates.
Expand Down Expand Up @@ -113,3 +114,6 @@ It is enabled by default in Kubernetes 1.21 and cannot be disabled since 1.22.
- With [Vault](https://github.com/hashicorp/secrets-store-csi-driver-provider-vault),
the Vault provider will send the token to Vault which will use the token in
`TokenReview` request to authenticate.
- With [Azure](https://github.com/Azure/secrets-store-csi-driver-provider-azure),
the driver will pass the token to Azure provider to exchange for Azure credentials, and then request
secrets from Key Vault.