Red Hat OpenShift Container Platform

Viewing the status of secrets in the pod volume mount

You can view detailed information of the secrets, including the versions, in the pod volume mount. You can use this information to help you confirm that secrets from your external store are active within the pod environment.

The Secrets Store CSI Driver Operator creates a SecretProviderClassPodStatus resource in the same namespace as the pod. You can review this resource to see detailed information, including versions, about the secrets in the pod volume mount.

Prerequisites

You have installed the Secrets Store CSI Driver Operator.
You have installed a secrets store provider.
You have created the secret provider class.
You have deployed a pod that mounts a volume from the Secrets Store CSI Driver Operator.
You have access to the cluster as a user with the cluster-admin role.

Procedure

View detailed information about the secrets in a pod volume mount by running the following command:

$ oc get secretproviderclasspodstatus <secret_provider_class_pod_status_name> -o yaml

Replace <secret_provider_class_pod_status_name> with the name of the secret provider class pod status object is in the format of <pod_name>-<namespace>-<secret_provider_class_name>.

Example output

...
status:
  mounted: true
  objects:
  - id: secret/tlscrt
    version: f352293b97da4fa18d96a9528534cb33
  - id: secret/tlskey
    version: 02534bc3d5df481cb138f8b2a13951ef
  podName: busybox-<hash>
  secretProviderClassName: my-azure-provider
  targetPath: /var/lib/kubelet/pods/f0d49c1e-c87a-4beb-888f-37798456a3e7/volumes/kubernetes.io~csi/secrets-store-inline/mount