如何通过EKS+Vault CSI Provider仅提取Secret核心数据？

场景：在EKS中使用Vault CSI Provider，将Vault KV中的密钥加载到Deployment并生成JSON文件，服务期望读取指定格式的密钥文件。

现有配置：

SecretProviderClass配置 #

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: CENSORED-secret-provider-class
  namespace: CENSORED
spec:
  parameters:
    objects: |
      - objectName: "CENSORED"
        secretPath: "CENSORED"
        secretKey: ""
        template: |
          {
            "BotToken": "{{ .data.BotToken }}",
            "Mongo": {
              "db": "{{ .data.Mongo.db }}",
              "host": "{{ .data.Mongo.host }}",
              "password": "{{ .data.Mongo.password }}",
              "port": {{ .data.Mongo.port }},
              "username": "{{ .data.Mongo.username }}"
            }
          }
    roleName: CENSORED
    vaultAddress: CENSORED
  provider: vault

Vault KV存储内容 #

/ $ vault kv get CENSORED
====== Data ======
Key         Value
---         -----
BotToken    CENSORED
Mongo       map[db:CENSORED host:CENSORED password:CENSORED port:CENSORED username:CENSORED]

Deployment相关配置 #

volumeMounts:
            - name: secret
              mountPath: CENSORED
              readOnly: true
      volumes:
      - name: secret
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "CENSORED"
            secretKey: ""

当前问题：
成功加载密钥后，生成的JSON文件包含request_id、lease_id等Vault API响应元数据，格式如下：

{
  "request_id": "...",
  "lease_id": "",
  "lease_duration": 2764800,
  "renewable": false,
  "data": {
    "BotToken": "...",
    "Mongo": {
      "db": "...",
      "host": "...",
      "password": "...",
      "port": ...,
      "username": "..."
    }
  }
}

期望结果：
仅保留data字段下的内容，格式如下：

{
  "BotToken": "...",
  "Mongo": {
    "db": "...",
    "host": "...",
    "password": "...",
    "port": ...,
    "username": "..."
  }
}

1. 开启模板渲染功能 #

在SecretProviderClass的spec.parameters中添加enableTemplates: "true"，这是模板生效的必要条件。

2. 完整调整后的SecretProviderClass配置 #

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: CENSORED-secret-provider-class
  namespace: CENSORED
spec:
  parameters:
    enableTemplates: "true"  # 新增：启用模板渲染逻辑
    objects: |
      - objectName: "ENV.json"  # 指定生成的目标文件名（匹配服务期望的文件名）
        secretPath: "CENSORED"
        template: |
          {
            "BotToken": "{{ .data.BotToken }}",
            "Mongo": {
              "db": "{{ .data.Mongo.db }}",
              "host": "{{ .data.Mongo.host }}",
              "password": "{{ .data.Mongo.password }}",
              "port": {{ .data.Mongo.port }},
              "username": "{{ .data.Mongo.username }}"
            }
          }
    roleName: CENSORED
    vaultAddress: CENSORED
  provider: vault

3. 清理Deployment冗余配置 #

移除volumes.csi.volumeAttributes中的secretKey: ""，使用模板时无需该配置：

volumes:
      - name: secret
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "CENSORED-secret-provider-class"  # 确保与SecretProviderClass名称一致

原理说明 #

• enableTemplates: "true"会让Vault CSI Provider跳过默认的完整API响应输出，转而使用你定义的模板生成文件。
• objectName直接指定生成的文件名，设置为服务期望的名称即可（比如ENV.json）。
• 模板中的{{ .data.BotToken }}等变量会直接引用Vault KV中存储的对应字段，渲染后生成纯净的目标JSON结构。

内容的提问来源于stack exchange，提问作者character