如何在AKS中通过CSI Secret Store Driver按需挂载Keyvault指定密钥？

针对你在AKS中使用CSI Secret Store Driver连接Keyvault时，希望在Pod卷级别选择特定密钥而非挂载全部的需求，有以下几种实现方式：

方法1：创建多个专用SecretProviderClass #

为不同应用分别定义只包含其所需密钥的SecretProviderClass，每个应用的Pod挂载对应的Class即可仅获取自身需要的密钥。

示例：针对App1的SecretProviderClass #

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: secretcls-app1
spec:
  provider: azure
  parameters:
    keyvaultName: "your-keyvault-name"
    tenantId: "your-tenant-id"
    objects: |
      array:
        - |
          objectName: app1-db-password
          objectType: secret
        - |
          objectName: app1-api-key
          objectType: secret

对应Pod配置 #

volumes:
  - name: secrets-provider-volume
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: secretcls-app1
containers:
  - name: your-app-container
    volumeMounts:
      - name: secrets-provider-volume
        mountPath: /etc/.secrets
        readOnly: true

方法2：使用Inline卷属性直接指定密钥（推荐） #

从CSI Secret Store Driver v1.1.0版本开始，支持在Pod的卷定义中直接指定要拉取的密钥，无需依赖预定义的SecretProviderClass，完全在卷级别控制所需密钥。

示例Pod配置 #

volumes:
  - name: secrets-provider-volume
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        provider: "azure"
        keyvaultName: "your-keyvault-name"
        tenantId: "your-tenant-id"
        objects: |
          array:
            - |
              objectName: app-db-password
              objectType: secret
            - |
              objectName: app-api-token
              objectType: secret
containers:
  - name: your-app-container
    volumeMounts:
      - name: secrets-provider-volume
        mountPath: /etc/.secrets
        readOnly: true

方法3：结合Secret同步与密钥投影 #

如果需要基于已有的全量密钥SecretProviderClass，可先将所需密钥同步到Kubernetes Secret，再通过密钥投影挂载特定密钥：

步骤1：修改SecretProviderClass添加同步配置 #

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: secretcls
spec:
  provider: azure
  parameters:
    keyvaultName: "your-keyvault-name"
    tenantId: "your-tenant-id"
    objects: |
      array:
        - |
          objectName: app1-db-password
          objectType: secret
        - |
          objectName: app2-api-key
          objectType: secret
  secretObjects:
    - data:
        - key: db-password
          objectName: app1-db-password
      secretName: app1-secret
      type: Opaque

步骤2：在Pod中使用密钥投影挂载 #

volumes:
  - name: projected-secrets
    projected:
      sources:
        - secret:
            name: app1-secret
            items:
              - key: db-password
                path: db/password
containers:
  - name: your-app-container
    volumeMounts:
      - name: projected-secrets
        mountPath: /etc/.secrets
        readOnly: true

以上三种方法中，方法2最贴近你提到的普通Secret密钥投影的使用方式，无需额外定义多个SecretProviderClass，直接在Pod卷配置中按需选择密钥。

内容的提问来源于stack exchange，提问作者Bennimi