# kubernetes-sigs/secrets-store-csi-driver

Secrets Store CSI driver for Kubernetes secrets - Integrates secrets stores with Kubernetes via a CSI volume.

Repository: https://github.com/kubernetes-sigs/secrets-store-csi-driver
Canonical: https://ross.abutalabs.com/products/secrets-store-csi-driver
Homepage: https://secrets-store-csi-driver.sigs.k8s.io/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: kubernetes, csi, hashicorp-vault, azure-keyvault, k8s-sig-auth, csi-secrets-store, mount-multiple-secrets, gcp-secret-manager, aws-secrets-manager
Last push: 2026-07-25T04:07:55+00:00

## Health v2 (maintenance only)
Score: 86/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 94, release rhythm 69, longevity 100
- inputs: {"age_days": 2800, "days_push": 39, "days_rel": 126, "gap_med": 59.5, "n_releases_24m": 11}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1557, forks 331 (observed 2026-08-28T04:05:03.352243+00:00)

## What it is
A Kubernetes CSI driver that mounts secrets, keys, and certificates from external secrets stores (Vault, Azure Key Vault, AWS Secrets Manager, GCP Secret Manager, and others) into pods as volumes. It is a Kubernetes SIG Auth subproject configured via SecretProviderClass custom resources, with optional syncing to Kubernetes Secrets and auto-rotation.

## Use cases
- mount vault secrets into kubernetes pods
- use azure key vault secrets in kubernetes containers
- mount aws secrets manager values as pod volumes
- sync external secrets store content into kubernetes secrets
- auto-rotate mounted secrets in kubernetes
- inject certificates and keys into pods from enterprise secret stores
- avoid storing secrets in kubernetes etcd

## When to choose
- you run workloads on Kubernetes and use an external secrets store like Vault, Azure Key Vault, AWS Secrets Manager, or GCP Secret Manager
- you want secrets mounted as files in pods rather than stored as Kubernetes Secrets
- you need pod portability across providers via SecretProviderClass
- you want automatic rotation of mounted secret content

## When to avoid
- you only need simple secrets stored natively in Kubernetes without external stores
- you are not running Kubernetes
- you need a secrets store itself rather than an integration driver
- you need alpha features like rotation or secret syncing without accepting upgrade churn

## Facets
- artifact type: service
- maturity: stable
- function: secrets-management, security, container-orchestration, deployment
- domain: security, cloud-computing, self-hosted
- platform: windows, go, cloud, self-hosted
- tags: csi-driver, kubernetes, hashicorp-vault, azure-keyvault, aws-secrets-manager, gcp-secret-manager, secret-rotation, helm-chart, sig-auth, containers, devops, docker, linux

## Member repositories
- kubernetes-sigs/secrets-store-csi-driver (main) score 86

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:03.352243+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:29:56.999155+00:00, confidence not recorded.
  - readme: https://github.com/kubernetes-sigs/secrets-store-csi-driver (fetched 2026-08-28T04:05:03.352243+00:00, sha 1b83323f825c)
  - homepage: https://secrets-store-csi-driver.sigs.k8s.io/ (fetched 2026-08-29T11:29:56.073507+00:00, sha 0dcd431a981e)
  - site_page: https://secrets-store-csi-driver.sigs.k8s.io/getting-started/getting-started (fetched 2026-08-29T11:29:56.076084+00:00, sha 4e675d008492)
  - site_page: https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation (fetched 2026-08-29T11:29:56.077802+00:00, sha 27b7b46246a4)
  - site_page: https://secrets-store-csi-driver.sigs.k8s.io/getting-started/usage (fetched 2026-08-29T11:29:56.080144+00:00, sha 77365e6e0921)
  - site_page: https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades (fetched 2026-08-29T11:29:56.081834+00:00, sha d0f59c7c629d)
  - site_page: https://secrets-store-csi-driver.sigs.k8s.io/design-docs (fetched 2026-08-29T11:29:56.083703+00:00, sha 655be1339c9c)
- Data as of 2026-08-30T08:39:29.467469+00:00.