Implicit mapping of secrets / objects - SecretProviderClass

[adlnc]

Implicit mapping of secrets / objects - SecretProviderClass

[tomhjp]

Hello 👋 these are good questions. I think there are a few pre-existing things to mention here.

• If you omit the secretKey, the whole JSON response will be written to the file/k8s secret (docs). So if you write many secrets to a single KV path (e.g. vault kv put secret/foo user=admin pass=hunter2 url=...), you can fetch all of those secret values in one SPC object.
• There is a PR on the driver (with some renewed interest in the most recent community call) to support transforming JSON file contents using JSON path: kubernetes-sigs/secrets-store-csi-driver#963
• There is a feature request on the driver to support syncing all files from a mount request into the k8s secret: kubernetes-sigs/secrets-store-csi-driver#529 - AFAIK this one is much less specced out than the transforms feature, so it's hard to say what the final functionality would look like, but I hope something like the below would be possible:

---
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
[...]
  secretObjects:
  - secretName: db-creds
    type: Opaque
    syncAll: true
  parameters:
    [...]
    objects: |
      - objectName: obj
        secretPath: "database/creds/db-app"
  transforms:
    - inFilePath: "obj"
      jsonPath: "$.username"
      outFilePath: "username"
    - inFilePath: "obj"
      jsonPath: "$.password"
      outFilePath: "password"

I think that gets relatively close to what you want, except you can still end up with quite an arduous number of transform entries.

The vault-csi-provider owns all of the config inside parameters, and the driver owns the rest, so while the features for syncAll for k8s secrets and transforms would be best/only possible to do in the driver, there is a potential feature request here to automatically create one object per key inside the secret's data field. Perhaps we could default to doing that if both objectName and secretKey are omitted.

Do you think that would fit your use-case?

[adlnc]

Thank you for your reply,

Simply put, the answer is yes ! I think you totally got what I'm looking for.
So you first remove my doubts that, at the moment, this doesn't seem to be supported.
Now, do you think such feature could be implemented and would be relevant ?

Yes, I tried playing with the full json response while omitting the secretKey but handling a single object here doesn't seem to fit my need.

In the end, if I get this right in order for this to work, this would require the default behavior you mention when objectName and secretKey are omitted (vault-csi provider) + that PR for transforms and SyncAll option to be merged (secret-store-driver).