如何通过SecretProviderClass将K8s密钥迁移至Azure Key Vault管理

前置准备 #

1. 在Azure Key Vault中创建/导入你的TLS证书（需包含私钥，类型选择“证书 + 私钥”）
2. 为Kubernetes集群使用的身份（服务主体或托管身份）配置Key Vault权限：至少需要Certificate/Get和Secret/Get权限（因为证书的私钥会以Secret形式存储在Key Vault中）

步骤1：手动部署Secrets Store CSI Driver及Azure Provider #

无需Helm，直接创建以下资源：

1.1 基础RBAC与命名空间

apiVersion: v1
kind: Namespace
metadata:
  name: secrets-store-csi-driver

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: secrets-store-csi-driver
  namespace: secrets-store-csi-driver

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secrets-store-csi-driver-cluster-role
rules:
- apiGroups: [""]
  resources: ["secrets", "pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "update", "patch", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: secrets-store-csi-driver-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: secrets-store-csi-driver-cluster-role
subjects:
- kind: ServiceAccount
  name: secrets-store-csi-driver
  namespace: secrets-store-csi-driver

1.2 部署CSI驱动DaemonSet

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: secrets-store.csi.k8s.io
spec:
  attachRequired: false
  podInfoOnMount: true
  volumeLifecycleModes: ["Persistent", "Ephemeral"]

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: secrets-store-csi-driver
  namespace: secrets-store-csi-driver
spec:
  selector:
    matchLabels:
      app: secrets-store-csi-driver
  template:
    metadata:
      labels:
        app: secrets-store-csi-driver
    spec:
      serviceAccountName: secrets-store-csi-driver
      containers:
      - name: secrets-store
        image: mcr.microsoft.com/k8s/csi/secrets-store/driver:v1.4.0
        args:
        - --debug=true
        - --endpoint=$(CSI_ENDPOINT)
        - --nodeid=$(KUBE_NODE_NAME)
        env:
        - name: CSI_ENDPOINT
          value: unix:///csi/csi.sock
        - name: KUBE_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        volumeMounts:
        - name: socket-dir
          mountPath: /csi
        - name: registration-dir
          mountPath: /registration
      volumes:
      - name: socket-dir
        hostPath:
          path: /var/lib/kubelet/plugins/secrets-store.csi.k8s.io
          type: DirectoryOrCreate
      - name: registration-dir
        hostPath:
          path: /var/lib/kubelet/plugins_registry/
          type: Directory

1.3 部署Azure Key Vault Provider

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secrets-store-csi-driver-provider-azure
  namespace: secrets-store-csi-driver
spec:
  replicas: 2
  selector:
    matchLabels:
      app: secrets-store-csi-driver-provider-azure
  template:
    metadata:
      labels:
        app: secrets-store-csi-driver-provider-azure
    spec:
      serviceAccountName: secrets-store-csi-driver
      containers:
      - name: provider-azure
        image: mcr.microsoft.com/k8s/csi/secrets-store/provider-azure:v1.4.0
        args:
        - --debug=true
        - --endpoint=$(CSI_ENDPOINT)
        env:
        - name: CSI_ENDPOINT
          value: unix:///provider/azure.sock
        volumeMounts:
        - name: socket-dir
          mountPath: /provider
      volumes:
      - name: socket-dir
        hostPath:
          path: /var/lib/kubelet/plugins/secrets-store.csi.k8s.io/provider/azure
          type: DirectoryOrCreate

步骤2：手动创建SecretProviderClass #

SecretProviderClass是CSI驱动的必要配置资源，这里手动创建而非通过Helm部署：

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-tls-secret
spec:
  provider: azure
  parameters:
    usePodIdentity: "false" # 使用服务主体时设为false，托管身份设为true
    keyvaultName: "你的Key Vault名称"
    tenantId: "你的Azure租户ID"
    objects: |
      array:
        - |
          objectName: "你的TLS证书名称" # Key Vault中证书的名称
          objectType: "certificate"
          objectVersion: "" # 留空自动同步最新版本

步骤3：配置身份验证（服务主体示例） #

创建存储Azure服务主体凭据的Kubernetes Secret：

apiVersion: v1
kind: Secret
metadata:
  name: azure-credentials
  namespace: default
type: Opaque
data:
  clientid: <base64编码的服务主体ID>
  clientsecret: <base64编码的服务主体密钥>

若使用托管身份，无需此步骤，只需为集群节点或Pod分配托管身份并赋予Key Vault权限

步骤4：修改Pod配置，替换为CSI卷 #

将原有的原生Secret卷替换为Secrets Store CSI卷：

apiVersion: v1
kind: Pod
metadata:
  name: secret-test-pod
spec:
  containers:
    - name: test-container
      image: nginx
      volumeMounts:
        - name: secret-volume
          mountPath: /etc/secret-dir
          readOnly: true
  volumes:
    - name: secret-volume
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "azure-tls-secret"
        # 若使用服务主体，需指定凭据Secret
        nodePublishSecretRef:
          name: azure-credentials

后续管理 #

当Azure Key Vault中的证书过期时，只需在Key Vault中更新证书（导入新证书或续订），CSI驱动会自动同步最新版本到Pod的挂载目录（默认同步间隔1小时，可通过SecretProviderClass的rotationPollInterval参数调整）。

内容的提问来源于stack exchange，提问作者leovigildorex