Cloud Experts Documentation

Installing the HashiCorp Vault Secret CSI Driver

This content is authored by Red Hat experts, but has not yet been tested on every supported configuration.

The HashiCorp Vault Secret CSI Driver allows you to access secrets stored in HashiCorp Vault as Kubernetes Volumes.


  1. An OpenShift Cluster (ROSA, ARO, OSD, and OCP 4.x all work)
  2. oc
  3. helm v3

Installing the Kubernetes Secret Store CSI

  1. Create an OpenShift Project to deploy the CSI into

    oc new-project k8s-secrets-store-csi
  2. Set SecurityContextConstraints to allow the CSI driver to run (otherwise the DaemonSet will not be able to create Pods)

    oc adm policy add-scc-to-user privileged \
  3. Add the Secrets Store CSI Driver to your Helm Repositories

    helm repo add secrets-store-csi-driver \
  4. Update your Helm Repositories

    helm repo update
  5. Install the secrets store csi driver

    helm install -n k8s-secrets-store-csi csi-secrets-store \
      secrets-store-csi-driver/secrets-store-csi-driver \
      --version v1.3.2 \
      --set "linux.providersDir=/var/run/secrets-store-csi-providers"
  6. Check that the Daemonsets is running

    oc -n k8s-secrets-store-csi get pods -l "app=secrets-store-csi-driver"

    You should see the following

    NAME                                               READY   STATUS    RESTARTS   AGE
    csi-secrets-store-secrets-store-csi-driver-cl7dv   3/3     Running   0          57s
    csi-secrets-store-secrets-store-csi-driver-gbz27   3/3     Running   0          57s
  7. Add pod security profile label for CSI Driver

    This is required starting in OpenShift v4.13
    oc label csidriver/

Install HashiCorp Vault with CSI driver enabled

  1. Add the HashiCorp Helm Repository

    helm repo add hashicorp
  2. Update your Helm Repositories

    helm repo update
  3. Create a namespace for Vault

    oc new-project hashicorp-vault
  4. Create a SCC for the CSI driver

    oc adm policy add-scc-to-user privileged \
  5. Create a values file for Helm to use

    cat << EOF > values.yaml
      openshift: true
      enabled: true
        providersDir: /var/run/secrets-store-csi-providers
      enabled: false
        repository: ""
        tag: "1.8.0-ubi"
        enabled: true
  6. Install Hashicorp Vault with CSI enabled

    helm install -n hashicorp-vault vault \
      hashicorp/vault --values values.yaml
  7. Patch the CSI daemonset

    Currently the CSI has a bug in its manifest which we need to patch

    oc patch daemonset vault-csi-provider --type='json' \
        -p='[{"op": "add", "path": "/spec/template/spec/containers/0/securityContext", "value": {"privileged": true} }]'

Configure Hashicorp Vault

  1. Get a bash prompt inside the Vault pod

    oc exec -it vault-0 -- bash
  2. Create a Secret in Vault

    vault kv put secret/db-pass password="hunter2"
  3. Configure Vault to use Kubernetes Auth

    vault auth enable kubernetes
  4. Check your Cluster’s token issuer in another terminal

    oc get authentication.config cluster \
      -o json | jq -r .spec.serviceAccountIssuer
  5. Configure Kubernetes auth method

    If the issuer here does not match the above, update it.

    vault write auth/kubernetes/config \
    issuer="https://kubernetes.default.svc.cluster.local" \
    token_reviewer_jwt="$(cat /var/run/secrets/" \
    kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
  6. Create a policy for our app

    vault policy write internal-app - <<EOF
    path "secret/data/db-pass" {
      capabilities = ["read"]
  7. Create an auth role to access it

    vault write auth/kubernetes/role/database \
      bound_service_account_names=webapp-sa \
      bound_service_account_namespaces=default \
      policies=internal-app \
  8. exit from the vault-0 pod


Deploy a sample application

  1. Create a SecretProviderClass in the default namespace

    cat <<EOF | oc apply -f -
    kind: SecretProviderClass
      name: vault-database
      namespace: default
      provider: vault
        vaultAddress: "http://vault.hashicorp-vault:8200"
        roleName: "database"
        objects: |
          - objectName: "db-password"
            secretPath: "secret/data/db-pass"
            secretKey: "password"
  2. Create a service account webapp-sa

    oc create serviceaccount -n default webapp-sa
  3. Create a Pod to use the secret

    cat << EOF | oc apply -f -
    kind: Pod
    apiVersion: v1
      name: webapp
      namespace: default
      serviceAccountName: webapp-sa
      - image: jweissig/app:0.0.1
        name: webapp
        - name: secrets-store-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
        - name: secrets-store-inline
            readOnly: true
              secretProviderClass: "vault-database"
  4. Check the Pod has the secret

    oc -n default exec webapp \
      -- cat /mnt/secrets-store/db-password

    The output should match


Uninstall HashiCorp Vault with CSI driver enabled

  1. Delete the pod and

    oc delete -n default pod webapp
    oc delete -n default secretproviderclass vault-database
    oc delete -n default serviceaccount webapp-sa
  2. Delete the Hashicorp Vault Helm

    helm delete -n hashicorp-vault vault
  3. Delete the SCC for Hashicorp Vault

    oc adm policy remove-scc-from-user privileged \
  4. Delete the Hashicorp vault project

    oc delete project hashicorp-vault

Uninstalling the Kubernetes Secret Store CSI

  1. Delete the secrets store csi driver

    helm delete -n k8s-secrets-store-csi csi-secrets-store
  2. Delete the SecurityContextConstraints

    oc adm policy remove-scc-from-user privileged \

Interested in contributing to these docs?

Collaboration drives progress. Help improve our documentation The Red Hat Way.

Red Hat logo LinkedIn YouTube Facebook Twitter



Try, buy & sell


About Red Hat

We’re the world’s leading provider of enterprise open source solutions—including Linux, cloud, container, and Kubernetes. We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Subscribe to our newsletter, Red Hat Shares

Sign up now
© 2023 Red Hat, Inc.