Use HashiCorp Vault to Manage PX-CSI Credentials

PX-CSI reads FlashArray and FlashBlade credentials from a Kubernetes Secret named px-pure-secret. You can use HashiCorp Vault with the Vault Secrets Operator (VSO) to store credentials centrally in Vault and automatically sync them into px-pure-secret. When Vault credentials change, VSO updates the Kubernetes Secret and PX-CSI picks up the new credentials without requiring a CSI driver restart.

note

Dynamic credential reload without a CSI restart requires PX-CSI 26.2.1 or later.

Prerequisites

• HashiCorp Vault running and reachable from your Kubernetes cluster
• VSO installed in your cluster. For installation instructions, see the Vault Secrets Operator documentation.
• KV v2 secret engine enabled in Vault
• Kubernetes authentication method enabled in Vault
• PX-CSI 26.2.1 or later

How VSO works with PX-CSI

VSO runs in the Kubernetes cluster and watches VaultStaticSecret custom resources. When a VaultStaticSecret resource is created, VSO reads the corresponding secret from Vault and writes it as a Kubernetes Secret. VSO periodically re-reads the Vault secret and updates the Kubernetes Secret when the content changes.

PX-CSI monitors px-pure-secret for changes. When VSO updates the secret after a credential rotation or configuration change, PX-CSI detects the update and reloads the backend credentials automatically.

Store PX-CSI credentials in Vault

Store your pure.json configuration as a secret in the Vault KV v2 engine. Use pure.json as the key name so that VSO writes the Kubernetes Secret with the key that PX-CSI expects.

vault kv put <kv-mount>/<path-to-secret> 'pure.json'='<pure-json-content>'

For example:

vault kv put kv/pxcsi/config 'pure.json'='{"FlashArrays":[{"MgmtEndPoint":"<fa-endpoint>","APIToken":"<api-token>"}]}'

For the structure and fields of pure.json, see Prepare FlashArray or Prepare FlashBlade.

Configure Vault Kubernetes authentication

VSO authenticates to Vault using the Kubernetes authentication method. The following steps configure Vault to accept authentication from VSO using a Kubernetes ServiceAccount.

1. Enable the Kubernetes auth method at a named mount path:

   vault auth enable -path=<auth-mount-name> kubernetes

2. Configure the Kubernetes auth method with your cluster API server address:

   vault write auth/<auth-mount-name>/config \
     kubernetes_host="https://<kubernetes-api-server>:6443"

3. Create a Vault policy that grants read access to the PX-CSI credentials secret:

   vault policy write px-csi-read - <<EOF
   path "<kv-mount>/data/<path-to-secret>" {
     capabilities = ["read"]
   }
   EOF

4. Create a Vault role that binds the policy to the VSO ServiceAccount:

   vault write auth/<auth-mount-name>/role/<vault-role-name> \
     bound_service_account_names=<vso-service-account> \
     bound_service_account_namespaces=<vso-namespace> \
     policies=px-csi-read \
     ttl=24h

For detailed Vault configuration instructions, see the HashiCorp Vault documentation.

Configure VSO custom resources

Create the VSO custom resources in the same namespace where PX-CSI is installed (the <stc-namespace>). Apply these resources before installing PX-CSI so that px-pure-secret exists when the CSI driver starts.

1. Create a VaultConnection resource that defines the connection to the Vault server:

   apiVersion: secrets.hashicorp.com/v1beta1
   kind: VaultConnection
   metadata:
     name: <vault-connection-name>
     namespace: <stc-namespace>
   spec:
     address: <vault-address>  # For example: https://vault.example.com:8200

   Apply the resource:

   kubectl apply -f vault-connection.yaml

2. Create a VaultAuth resource that configures Kubernetes authentication to Vault:

   apiVersion: secrets.hashicorp.com/v1beta1
   kind: VaultAuth
   metadata:
     name: <vault-auth-name>
     namespace: <stc-namespace>
   spec:
     vaultConnectionRef: <vault-connection-name>
     method: kubernetes
     mount: <auth-mount-name>
     kubernetes:
       role: <vault-role-name>
       serviceAccount: <vso-service-account>

   Apply the resource:

   kubectl apply -f vault-auth.yaml

3. Create a VaultStaticSecret resource that syncs the Vault secret into the px-pure-secret Kubernetes Secret:

   apiVersion: secrets.hashicorp.com/v1beta1
   kind: VaultStaticSecret
   metadata:
     name: px-pure-secret-sync
     namespace: <stc-namespace>
   spec:
     vaultAuthRef: <vaultauth-namespace>/<vault-auth-name>
     mount: <kv-mount>
     type: kv-v2
     path: <path-to-secret>
     destination:
       name: px-pure-secret
       create: true
     refreshAfter: 30s

   Apply the resource:

   kubectl apply -f vault-static-secret.yaml

   VSO creates the px-pure-secret Kubernetes Secret in the <stc-namespace> namespace with the credentials read from Vault. PX-CSI reads from this secret and reloads the configuration automatically when the secret changes.

Verify the Vault integration

1. Check that the VaultStaticSecret resource is synchronized:

   kubectl get vaultstaticsecret px-pure-secret-sync -n <stc-namespace>

   A successfully synchronized resource shows True in the Ready column.

2. Verify that the px-pure-secret Kubernetes Secret was created and contains the expected data:

   kubectl get secret px-pure-secret -n <stc-namespace> \
     -o jsonpath='{.data.pure\.json}' | base64 -d

   The output should match the JSON content stored in Vault.

Related topics

• Prepare FlashArray
• Prepare FlashBlade
• pure.json reference
• Install Portworx CSI