Kubernetes CSI

​

Overview

The Infisical CSI provider allows you to use Infisical with the Secrets Store CSI driver to inject secrets directly into your Kubernetes pods through a volume mount. In contrast to the Infisical Kubernetes Operator, the Infisical CSI provider will allow you to sync Infisical secrets directly to pods as files, removing the need for Kubernetes secret resources.

​

Features

The following features are supported by the Infisical CSI Provider:

• Integration with Secrets Store CSI Driver for direct pod mounting
• Authentication using Kubernetes service accounts via machine identities
• Auto-syncing secrets when enabled via CSI Driver
• Configurable secret paths and file mounting locations
• Installation via Helm

​

Prerequisites

The Infisical CSI provider is only supported for Kubernetes clusters with version >= 1.20.

​

Limitations

Currently, the Infisical CSI provider only supports static secrets.

​

Deploy to Kubernetes cluster

​

Install Secrets Store CSI Driver

In order to use the Infisical CSI provider, you will first have to install the Secrets Store CSI driver to your cluster.

​

Standard Installation

For most Kubernetes clusters, use the following installation:

helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts

helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
--namespace=kube-system \
--set "tokenRequests[0].audience=infisical" \
--set enableSecretRotation=true \
--set rotationPollInterval=2m \
--set "syncSecret.enabled=true" \

The flags configure the following:

• tokenRequests[0].audience=infisical: Sets the audience value for service account token authentication (recommended for environments that support custom audiences)
• enableSecretRotation=true: Enables automatic secret updates from Infisical
• rotationPollInterval=2m: Checks for secret updates every 2 minutes
• syncSecret.enabled=true: Enables syncing secrets to Kubernetes secrets

​

Installation for Environments Without Custom Audience Support

Some Kubernetes environments (such as AWS EKS) don’t support custom audiences and will reject tokens with non-default audiences. For these environments, use this installation instead:

helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
--namespace=kube-system \
--set enableSecretRotation=true \
--set rotationPollInterval=2m \
--set "syncSecret.enabled=true" \

​

Install Infisical CSI Provider

You would then have to install the Infisical CSI provider to your cluster.

Install the latest Infisical Helm repository

helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'

helm repo update

Install the Helm Chart

helm install infisical-csi-provider infisical-helm-charts/infisical-csi-provider

For a list of all supported arguments for the helm installation, you can run the following:

helm show values infisical-helm-charts/infisical-csi-provider

​

Authentication

In order for the Infisical CSI provider to pull secrets from your Infisical project, you will have to configure a machine identity with Kubernetes authentication configured with your cluster. You can refer to the documentation for setting it up here.

​

Creating Secret Provider Class

With the Secrets Store CSI driver and the Infisical CSI provider installed, create a Kubernetes SecretProviderClass resource to establish the connection between the CSI driver and the Infisical CSI provider for secret retrieval. You can create as many Secret Provider Classes as needed for your cluster.

​

Standard Configuration

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-infisical-app-csi-provider
spec:
  provider: infisical
  parameters:
    infisicalUrl: "https://app.infisical.com"
    authMethod: "kubernetes"
    identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
    projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
    envSlug: "prod"
    secrets: |
      - secretPath: "/"
        fileName: "dbPassword"
        secretKey: "DB_PASSWORD"
      - secretPath: "/app"
        fileName: "appSecret"
        secretKey: "APP_SECRET"

​

Configuration for Environments Without Custom Audience Support

For environments that don’t support custom audiences (such as AWS EKS), use this configuration instead:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-infisical-app-csi-provider
spec:
  provider: infisical
  parameters:
    infisicalUrl: "https://app.infisical.com"
    authMethod: "kubernetes"
    useDefaultAudience: "true"
    identityId: "ad2f8c67-cbe2-417a-b5eb-1339776ec0b3"
    projectId: "09eda1f8-85a3-47a9-8a6f-e27f133b2a36"
    envSlug: "prod"
    secrets: |
      - secretPath: "/"
        fileName: "dbPassword"
        secretKey: "DB_PASSWORD"
      - secretPath: "/app"
        fileName: "appSecret"
        secretKey: "APP_SECRET"

​

Supported Parameters

​

Using Secret Provider Class

A pod can use the Secret Provider Class by mounting it as a CSI volume:

apiVersion: v1
kind: Pod
metadata:
  name: nginx-secrets-store
  labels:
    app: nginx
spec:
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
        - name: secrets-store-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "my-infisical-app-csi-provider"

When the pod is created, the secrets are mounted as individual files in the /mnt/secrets-store directory.

​

Verifying Secret Mounts

To verify your secrets are mounted correctly:

# Check pod status
kubectl get pod nginx-secrets-store

# View mounted secrets
kubectl exec -it nginx-secrets-store -- ls -l /mnt/secrets-store

​

Troubleshooting

To troubleshoot issues with the Infisical CSI provider, refer to the logs of the Infisical CSI provider running on the same node as your pod.

kubectl logs infisical-csi-provider-7x44t

You can also refer to the logs of the secrets store CSI driver. Modify the command below with the appropriate pod and namespace of your secrets store CSI driver installation.

kubectl logs csi-secrets-store-csi-driver-7h4jp -n=kube-system

Common issues include:

• Mismatch in the audience value of the CSI driver with the machine identity’s Kubernetes auth configuration
• SecretProviderClass in the wrong namespace
• Invalid machine identity configuration
• Incorrect secret paths or keys

Issues in environments without custom audience support:

• Token authentication failed with custom audience: If you’re seeing authentication errors in environments that don’t support custom audiences (such as AWS EKS), ensure you’re using the installation without custom audience and have set useDefaultAudience: "true" in your SecretProviderClass
• Audience not allowed errors: Make sure the “Allowed Audience” field is left empty in your machine identity’s Kubernetes authentication configuration when using environments that don’t support custom audiences

​

Best Practices

For additional guidance on setting this up for your production cluster, you can refer to the Secrets Store CSI driver documentation here.

​

Frequently Asked Questions