{"id":15221745,"url":"https://github.com/googlecloudplatform/secrets-store-csi-driver-provider-gcp","last_synced_at":"2025-05-16T09:03:54.209Z","repository":{"id":39674369,"uuid":"267427111","full_name":"GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp","owner":"GoogleCloudPlatform","description":"Google Secret Manager provider for the Secret Store CSI Driver.","archived":false,"fork":false,"pushed_at":"2025-05-12T14:22:00.000Z","size":4832,"stargazers_count":247,"open_issues_count":48,"forks_count":68,"subscribers_count":26,"default_branch":"main","last_synced_at":"2025-05-12T15:00:01.288Z","etag":null,"topics":["csi","gcp","gcp-secret-manager","google-cloud-platform","kubernetes","secrets"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GoogleCloudPlatform.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"docs/contributing.md","funding":null,"license":"LICENSE","code_of_conduct":"docs/code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-05-27T21:10:47.000Z","updated_at":"2025-05-12T09:27:49.000Z","dependencies_parsed_at":"2023-10-29T18:45:07.667Z","dependency_job_id":"317e022f-12a8-402b-9aa8-e8d2961277ab","html_url":"https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fsecrets-store-csi-driver-provider-gcp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fsecrets-store-csi-driver-provider-gcp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fsecrets-store-csi-driver-provider-gcp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fsecrets-store-csi-driver-provider-gcp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GoogleCloudPlatform","download_url":"https://codeload.github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254501556,"owners_count":22081528,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csi","gcp","gcp-secret-manager","google-cloud-platform","kubernetes","secrets"],"created_at":"2024-09-28T15:07:16.239Z","updated_at":"2025-05-16T09:03:54.191Z","avatar_url":"https://github.com/GoogleCloudPlatform.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Google Secret Manager Provider for Secret Store CSI Driver\n\n[![e2e](https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/actions/workflows/e2e.yml/badge.svg)](https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/actions/workflows/e2e.yml)\n\n[Google Secret Manager](https://cloud.google.com/secret-manager/) provider for\nthe [Secret Store CSI\nDriver](https://github.com/kubernetes-sigs/secrets-store-csi-driver). Allows you\nto access secrets stored in Secret Manager as files mounted in Kubernetes pods.\n\n## Install\n\n* Create a new GKE cluster with Workload Identity or enable\n  [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#enable_on_existing_cluster)\n  on an existing cluster.\n* Install the\n  [Secret Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation.html)\n  v1.0.1 or higher to the cluster.\n* Install the Google plugin DaemonSet \u0026 additional RoleBindings:\n\n```shell\nkubectl apply -f deploy/provider-gcp-plugin.yaml\n# if you want to use helm\n# helm upgrade --install secrets-store-csi-driver-provider-gcp charts/secrets-store-csi-driver-provider-gcp\n```\n\nNOTE: The driver's rotation and secret syncing functionality is still in Alpha and requires [additional installation\nsteps](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation.html#optional-values).\n\n## Usage\n\nThe provider will use the workload identity of the pod that a secret is mounted\nonto when authenticating to the Google Secret Manager API. For this to work the\nworkload identity of the pod must be configured and appropriate IAM bindings\nmust be applied.\n\n* Setup the workload identity service account.\n\n```shell\n$ export PROJECT_ID=\u003cyour gcp project\u003e\n$ gcloud config set project $PROJECT_ID\n# Create a service account for workload identity\n$ gcloud iam service-accounts create gke-workload\n\n# Allow \"default/mypod\" to act as the new service account\n$ gcloud iam service-accounts add-iam-policy-binding \\\n    --role roles/iam.workloadIdentityUser \\\n    --member \"serviceAccount:$PROJECT_ID.svc.id.goog[default/mypodserviceaccount]\" \\\n    gke-workload@$PROJECT_ID.iam.gserviceaccount.com\n```\n\n* Create a secret that the workload identity service account can access\n\n```shell\n# Create a secret with 1 active version\n$ echo \"foo\" \u003e secret.data\n$ gcloud secrets create testsecret --replication-policy=automatic --data-file=secret.data\n$ rm secret.data\n\n# grant the new service account permission to access the secret\n$ gcloud secrets add-iam-policy-binding testsecret \\\n    --member=serviceAccount:gke-workload@$PROJECT_ID.iam.gserviceaccount.com \\\n    --role=roles/secretmanager.secretAccessor\n```\n\n* Note: Regional secrets are also supported from v1.6.0, Please see [Regional Secret Documentation](https://cloud.google.com/secret-manager/regional-secrets/config-sm-rs).\n\n* Try it out the [example](./examples) which attempts to mount the secret \"test\" in `$PROJECT_ID` to `/var/secrets/good1.txt` and `/var/secrets/good2.txt`\n\n```shell\n$ ./scripts/example.sh\n$ kubectl exec -it mypod /bin/bash\nroot@mypod:/# ls /var/secrets\n```\n\n## Security Considerations\n\nThis plugin is built to ensure compatibility between Secret Manager and\nKubernetes workloads that need to load secrets from the filesystem. It also\nenables syncing of those secrets to Kubernetes-native secrets for consumption\nas environment variables.\n\nWhen evaluating this plugin consider the following threats:\n\n* When a secret is accessible on the **filesystem**, application vulnerabilities\n  like [directory traversal][directory-traversal] attacks can become higher\n  severity as the attacker may gain the ability to read the secret material.\n* When a secret is consumed through **environment variables**, misconfigurations\n  such as enabling a debug endpoint or including dependencies that log process\n  environment details may leak secrets.\n* When **syncing** secret material to another data store (like Kubernetes\n  Secrets), consider whether the access controls on that data store are\n  sufficiently narrow in scope.\n\nFor these reasons, _when possible_ we recommend using the Secret Manager API\ndirectly (using one of the provided [client libraries][client-libraries], or by\nfollowing the [REST][rest] or [GRPC][grpc] documentation).\n\n[client-libraries]: https://cloud.google.com/secret-manager/docs/reference/libraries\n[rest]: https://cloud.google.com/secret-manager/docs/reference/rest\n[grpc]: https://cloud.google.com/secret-manager/docs/reference/rpc\n[directory-traversal]: https://en.wikipedia.org/wiki/Directory_traversal_attack\n\n## Contributing\n\nPlease see the [contributing guidelines](docs/contributing.md).\n\n## Support\n\n__This is not an officially supported Google product.__\n\nFor support\n[please search open issues here](https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/issues),\nand if your issue isn't already represented please\n[open a new one](https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp/issues/new/choose).\nPull requests and issues will be triaged weekly.\n\nWe close issues after 30 days if there's been no response or action taken.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgooglecloudplatform%2Fsecrets-store-csi-driver-provider-gcp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgooglecloudplatform%2Fsecrets-store-csi-driver-provider-gcp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgooglecloudplatform%2Fsecrets-store-csi-driver-provider-gcp/lists"}