Google Secret Manager Provider for Secret Store CSI Driver

Google Secret Manager provider for the Secret Store CSI Driver. Allows you to access secrets stored in Secret Manager as files mounted in Kubernetes pods.

Install

• Create a new GKE cluster with K8S 1.16+ and enable Workload Identity.
• Install Secret Store CSI Driver v0.0.17 or higher to the cluster.
• Install the plugin DaemonSet & additional RoleBindings:

$ kubectl apply -f deploy/provider-gcp-plugin.yaml

Usage

• Setup the workload identity service account.

$ export PROJECT_ID=<your gcp project>
$ gcloud config set project $PROJECT_ID
# Create a service account for workload identity
$ gcloud iam service-accounts create gke-workload

# Allow "default/mypod" to act as the new service account
$ gcloud iam service-accounts add-iam-policy-binding \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:$PROJECT_ID.svc.id.goog[default/mypodserviceaccount]" \
    [email protected]$PROJECT_ID.iam.gserviceaccount.com

• Create a secret that the workload identity service account can access

# Create a secret with 1 active version
$ echo "foo" > secret.data
$ gcloud secrets create testsecret --replication-policy=automatic --data-file=secret.data
$ rm secret.data

# grant the new service account permission to access the secret
$ gcloud secrets add-iam-policy-binding testsecret \
    --member=serviceAccount:[email protected]$PROJECT_ID.iam.gserviceaccount.com \
    --role=roles/secretmanager.secretAccessor

• Try it out the example which attempts to mount the secret "test" in $PROJECT_ID to /var/secrets/good1.txt and /var/secrets/good2.txt

$ ./scripts/example.sh
$ kubectl exec -it mypod /bin/bash
ls /var/secrets

Security Considerations

This plugin is built to ensure compatibility between Secret Manager and Kubernetes workloads that need to load secrets from the filesystem. It also enables syncing of those secrets to Kubernetes-native secrets for consumption as environment variables.

When evaluating this plugin consider the following threats:

• When a secret is accessible on the filesystem, application vulnerabilities like directory traversal attacks can become higher severity as the attacker may gain the ability read the secret material.
• When a secret is consumed through environment variables, misconfigurations such as enabling a debug endpoints or including dependencies that log process environment details may leak secrets.
• When syncing secret material to another data store (like Kubernetes Secrets), consider whether the access controls on that data store are sufficiently narrow in scope.

For these reasons, when possible we recommend using the Secret Manager API directly (using one of the provided client libraries, or by following the REST or GRPC documentation).

Contributing

Please see the contributing guidelines.

Support

This is not an officially supported Google product.

For support please search open issues here, and if your issue isn't already represented please open a new one. Pull requests and issues will be triaged weekly.