https://lesitedefrancois.be/en/tags/csi/Recent content in Csi on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/csi-secret-store/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/csi-secret-store/<p><strong>Secrets Store CSI Driver</strong> (formally <code>secrets-store.csi.k8s.io</code>) is a Kubernetes SIG Auth project that uses the Container Storage Interface to mount secrets, certificates, and keys from external secret backends directly into pod filesystems as ephemeral <code>tmpfs</code> volumes, bypassing the Kubernetes <code>Secret</code> object and etcd entirely. The driver runs as a DaemonSet on every node; when a pod referencing a CSI volume of type <code>secrets-store.csi.k8s.io</code> is scheduled, the driver communicates with a <strong>provider plugin</strong> over gRPC to retrieve the secret content from the configured backend, writes it to a per-pod <code>tmpfs</code> mount, and makes it available inside the container at the specified path. When the pod terminates, the <code>tmpfs</code> is unmounted and the data is gone — secrets have no persistence beyond the lifetime of the pod that requested them.</p>