CSI Provider - Infisical

The Infisical CSI Provider integrates with the Secrets Store CSI Driver to mount Infisical secrets directly into Kubernetes pods as files, without creating Kubernetes Secret resources. For usage details including SecretProviderClass configuration and pod mounting, see the CSI Provider documentation.

Installation

Install the Secrets Store CSI Driver

The CSI Driver must be installed first:

helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts

Standard
Without custom audience (e.g., EKS)

helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
  --namespace kube-system \
  --set "tokenRequests[0].audience=infisical" \
  --set enableSecretRotation=true \
  --set rotationPollInterval=2m \
  --set "syncSecret.enabled=true"

helm install csi secrets-store-csi-driver/secrets-store-csi-driver \
  --namespace kube-system \
  --set enableSecretRotation=true \
  --set rotationPollInterval=2m \
  --set "syncSecret.enabled=true"

Set useDefaultAudience: "true" in your SecretProviderClass when using this installation.

Install the Infisical CSI Provider

helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
helm repo update

helm install infisical-csi-provider infisical-helm-charts/infisical-csi-provider

Verify the deployment

kubectl get pods -n kube-system -l app=infisical-csi-provider

Uninstall

helm uninstall infisical-csi-provider

Configuration Reference

Parameter	Default	Description
`name`	`infisical-csi-provider`	Name of the CSI provider deployment.
`namespace`	`kube-system`	Namespace for the provider.
`image.repository`	`infisical/infisical-csi-provider`	Container image.
`image.tag`	`v0.0.7`	Image tag.
`image.pullPolicy`	`IfNotPresent`	Image pull policy.
`resources.requests.cpu`	`50m`	CPU request.
`resources.requests.memory`	`100Mi`	Memory request.
`resources.limits.cpu`	`50m`	CPU limit.
`resources.limits.memory`	`100Mi`	Memory limit.
`nodeSelector`	`{ kubernetes.io/os: linux }`	Node selector. Defaults to Linux nodes only.
`tolerations`	`[]`	Pod tolerations.
`labels`	`{}`	Additional labels for resources.
`podLabels`	`{}`	Additional labels for pods.

Default Helm Values

# Name of the CSI provider deployment
name: infisical-csi-provider
# Namespace where CSI provider will be deployed
namespace: kube-system

# Container image configuration
image:
  repository: infisical/infisical-csi-provider
  tag: v0.0.7
  pullPolicy: IfNotPresent

# Infisical provider arguments
args:
  - -endpoint=/provider/infisical.sock

# Unix domain socket path for CSI driver communication
endpoint: /provider/infisical.sock

# Resource limits and requests
resources:
  requests:
    cpu: 50m
    memory: 100Mi
  limits:
    cpu: 50m
    memory: 100Mi

# Volume configuration for provider socket
providerVolume:
  mountPath: /provider
  hostPath: /etc/kubernetes/secrets-store-csi-providers

# Health check for container liveness
livenessProbe:
  httpGet:
    path: /health/ready
    port: 8080
    scheme: HTTP
  failureThreshold: 2
  initialDelaySeconds: 5
  periodSeconds: 5
  successThreshold: 1
  timeoutSeconds: 3

# Health check for container readiness
readinessProbe:
  httpGet:
    path: /health/ready
    port: 8080
    scheme: HTTP
  failureThreshold: 2
  initialDelaySeconds: 5
  periodSeconds: 5
  successThreshold: 1
  timeoutSeconds: 3

# Node selection criteria
nodeSelector:
  kubernetes.io/os: linux

# Optional configurations
labels: {}
podLabels: {}
tolerations: []

​Installation

​Uninstall

​Configuration Reference

​Default Helm Values

Installation

Uninstall

Configuration Reference

Default Helm Values