Mutating Web Hook or CSI Provider

[hashicorp]

Mutating Web Hook or CSI Provider

[BadLiveware]

Additionally, the CSI driver works seamlessly with istio while the injector fails unless configured to exclude the port used by the sidecar to talk to vault.

[tomhjp]

Hi @michael-bowen-sc, welcome to the project! And good question. We plan to support both going forwards, though the Vault Agent injector is more mature technically. So which you choose is a matter of trading off the capabilities and stability you need, and of course there are also security model and deployment-specific considerations. The biggest considerations that come to mind for me are:

• The injector containers run as the consuming pod's service account, whereas CSI needs permission to create a bound service account token to impersonate any consuming pod's service account [security]
• CSI requires writeable hostPath volumes to communicate with the driver and write to the pod's volume (the latter will be removed in a later version) [security]
• Only CSI can sync to k8s secrets [capability]
• The injector has been much more widely deployed and tested in real production environments as of today [stability]
• CSI deploys as a daemonset, whereas injector adds containers to each consuming pod, so CSI will normally have fewer containers [deployment]

I would love to hear the community's input on how important each of these points are, and whether I've missed other stuff.

[tomhjp]

One additional point on stability, as stated in the readme, the Vault CSI provider currently depends on alpha Kubernetes APIs and the Secrets Store CSI driver itself is currently alpha. There is a milestone on the driver project working towards stability here: https://github.com/kubernetes-sigs/secrets-store-csi-driver/milestone/5.

This project is currently supported as a Beta product, but relies on Alpha Kubernetes APIs and the CSI secrets store driver which is also Alpha. Where possible we will provide upgrade paths and deprecation notices for future releases, but cannot guarantee a stable API.

[sidewinder12s]

Thanks for the rundown, I think it’d be really great to get this and content from the recent blog post into the project readmes, as this was the first question I had after seeing the CSI driver project.

https://www.hashicorp.com/blog/retrieve-hashicorp-vault-secrets-with-kubernetes-csi

[tomhjp]

Couple of updates on this:

• We'll be working on some comparison documentation for vaultproject.io soon
• There is also now a blog directly comparing the two here

[tomhjp]

Thanks for the input all. We've now added a comparison on our documentation site here: https://www.vaultproject.io/docs/platform/k8s/injector-csi