### Cloud Build URL example

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Example of the Cloud Build URL found in the build logs.

```text
Created [https://cloudbuild.googleapis.com/v1/projects/k8s-staging-csi-secrets-store/locations/global/builds/<number>].
```

--------------------------------

### Example SecretProviderClass for Azure

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/concepts.md

An example SecretProviderClass configured for Azure Key Vault, specifying identity usage, Key Vault name, and desired objects.

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-provider
  namespace: default
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useManagedIdentity: "false"
    keyvaultName: "$KEYVAULT_NAME"
    objects: |
      array:
        - |
          objectName: $SECRET_NAME
          objectType: secret
          objectVersion: $SECRET_VERSION
        - |
          objectName: $KEY_NAME
          objectType: key
          objectVersion: $KEY_VERSION
    tenantId: "$TENANT_ID"
```

--------------------------------

### Run End-to-End Tests (Azure)

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/testing.md

Run end-to-end tests against an Azure Kubernetes cluster. Requires kubectl, helm, and bats to be installed.

```bash
make e2e-azure
```

--------------------------------

### Run End-to-End Tests (GCP)

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/testing.md

Run end-to-end tests against a GCP Kubernetes cluster. Requires kubectl, helm, and bats to be installed.

```bash
make e2e-gcp
```

--------------------------------

### Install Secrets Store CSI Driver using Helm

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/installation.md

Use this Helm command to install the Secrets Store CSI Driver on Linux nodes in the kube-system namespace. Ensure Helm3 is used.

```bash
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace kube-system
```

--------------------------------

### Run End-to-End Tests (Vault)

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/testing.md

Run end-to-end tests against a Vault Kubernetes cluster. Requires kubectl, helm, and bats to be installed.

```bash
make e2e-vault
```

--------------------------------

### Describe Application Pod for Mount Failures

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

Use `kubectl describe pod` to view detailed information, including mount failure errors and events, for your application pod. This is useful when the pod fails to start due to inline volume mounts.

```bash
kubectl describe pod <application pod>
```

--------------------------------

### Mount Secrets in a Pod

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/sync-as-kubernetes-secret.md

Example Pod configuration that mounts the secrets defined in the SecretProviderClass.

```yaml
kind: Pod
apiVersion: v1
metadata:
  name: secrets-store-inline
spec:
  containers:
    - name: busybox
      image: registry.k8s.io/e2e-test-images/busybox:1.29
      command:
      - "/bin/sleep"
      - "10000"
      volumeMounts:
      - name: secrets-store01-inline
        mountPath: "/mnt/secrets-store"
        readOnly: true
  volumes:
    - name: secrets-store01-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "azure-sync"
```

--------------------------------

### Enable and Access pprof Debugging Endpoint

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

Start the secrets-store container with `--enable-pprof=true` to enable a debug HTTP endpoint. Access this endpoint using `kubectl port-forward` to gather performance and debugging information.

```bash
kubectl port-forward csi-secrets-store-secrets-store-csi-driver-7x44t secrets-store 6065:6065 &
curl localhost:6065/debug/pprof
```

--------------------------------

### Example SecretProviderClassPodStatus Resource

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/concepts.md

This YAML defines a SecretProviderClassPodStatus resource, showing the status of secrets mounted by the CSI driver for a specific pod and SecretProviderClass. It includes details like mounted status, object IDs and versions, pod name, and the target mount path.

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClassPodStatus
metadata:
  creationTimestamp: "2021-01-21T19:20:11Z"
  generation: 1
  labels:
    internal.secrets-store.csi.k8s.io/node-name: kind-control-plane
    manager: secrets-store-csi
    operation: Update
    time: "2021-01-21T19:20:11Z"
  name: nginx-secrets-store-inline-crd-dev-azure-spc
  namespace: dev
  ownerReferences:
  - apiVersion: v1
    kind: Pod
    name: nginx-secrets-store-inline-crd
    uid: 10f3e31c-d20b-4e46-921a-39e4cace6db2
  resourceVersion: "1638459"
  selfLink: /apis/secrets-store.csi.x-k8s.io/v1/namespaces/dev/secretproviderclasspodstatuses/nginx-secrets-store-inline-crd
  uid: 1d078ad7-c363-4147-a7e1-234d4b9e0d53
status:
  mounted: true
  objects:
  - id: secret/secret1
    version: c55925c29c6743dcb9bb4bf091be03b0
  - id: secret/secret2
    version: 7521273d0e6e427dbda34e033558027a
  podName: nginx-secrets-store-inline-crd
  secretProviderClassName: azure-spc
  targetPath: /var/lib/kubelet/pods/10f3e31c-d20b-4e46-921a-39e4cace6db2/volumes/kubernetes.io~csi/secrets-store-inline/mount

```

--------------------------------

### Add Secrets Store CSI Driver Helm Repository

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/charts/secrets-store-csi-driver/README.md

Adds the official Helm repository for the Secrets Store CSI Driver. Ensure Helm is installed and configured.

```bash
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
```

--------------------------------

### Verify CSI Driver Registration

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

This command checks if the Secrets Store CSI driver is registered in the cluster. If `secrets-store.csi.k8s.io` is not found, the CSI driver pods may not be running or the driver might not be installed correctly.

```bash
# This is the desired output. If the secrets-store.csi.k8s.io isn't found, then reinstall the driver.
kubectl get csidriver
NAME                       ATTACHREQUIRED   PODINFOONMOUNT   MODES       AGE
secrets-store.csi.k8s.io   false            true             Ephemeral   110m
```

--------------------------------

### Reference Kubernetes Secret as ENV Var

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/set-as-env-var.md

Example of how to reference a Kubernetes secret, previously synced by the CSI driver, as an environment variable within a container.

```yaml
spec:
  containers:
  - image: registry.k8s.io/e2e-test-images/busybox:1.29
    name: busybox
    command:
    - "/bin/sleep"
    - "10000"
    env:
    - name: SECRET_USERNAME
      valueFrom:
        secretKeyRef:
          name: foosecret
          key: username

```

--------------------------------

### Viewing SecretProviderClassPodStatus

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/secret-auto-rotation.md

Use kubectl to get the status of secrets loaded into a pod mount, including their versions. This helps track the binding between a pod and its SecretProviderClass.

```yaml
➜ kubectl get secretproviderclasspodstatus nginx-secrets-store-inline-crd-default-azure-spc -o yaml
...
status:
  mounted: true
  objects:
  - id: secret/secret1
    version: b82206cb5ac249918008b0b97fd1fd66
  - id: key/key1
    version: 7cc095105411491b84fe1b92ebbcf01a
  podName: nginx-secrets-store-inline-multiple-crd
  secretProviderClassName: azure-spc
  targetPath: /var/lib/kubelet/pods/1b7b0740-62d5-4776-a0df-90d060ef35ba/volumes/kubernetes.io~csi/secrets-store-inline-0/mount
```

--------------------------------

### Get Secrets Store CSI Driver Pod Logs

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

Retrieve logs from the secrets-store container within the CSI driver pod to diagnose issues. Ensure you identify the correct pod running on the same node as your application.

```bash
kubectl get pod -o wide
# find the secrets store csi driver pod running on the same node as your application pod

kubectl logs csi-secrets-store-secrets-store-csi-driver-7x44t secrets-store
```

--------------------------------

### Run Unit Tests

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/testing.md

Execute unit tests locally using the make command. Ensure you have the necessary build environment set up.

```bash
make test
```

--------------------------------

### Configure Custom Kubelet Root Directory

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

For Kubernetes distributions using a custom `kubeletRootDir` path (e.g., Rancher, Microk8s), configure the Helm chart with `--set linux.kubeletRootDir=<desired/kubelet/dir/path>` to resolve potential CSI driver registration or volume mount issues.

```bash
--set linux.kubeletRootDir=<desired/kubelet/dir/path>
```

--------------------------------

### Preview manifest changes

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Command to review changes before committing to the image promoter repository.

```bash
git diff
```

--------------------------------

### Promote Staging Manifest

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Use this command to generate patch and promote staging manifests to release. Ensure NEWVERSION and CURRENTVERSION are updated.

```bash
make promote-staging-manifest NEWVERSION=0.0.12 CURRENTVERSION=0.0.11
```

--------------------------------

### Tag and Push Release

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Clone the repository, checkout the release branch, tag the release with the semantic version, and push the tags. Replace <RELASE_BRANCH> and <NEW_VERSION>.

```bash
git clone git@github.com:kubernetes-sigs/secrets-store-csi-driver.git
cd secrets-store-csi-driver
git checkout <RELASE_BRANCH>
git tag -a v<NEW_VERSION> -m "release: <NEW_VERSION>" # NEW_VERSION is the semantic version of the release and will contain the v prefix. e.g. v1.0.0
git push origin --tags
```

--------------------------------

### Run e2e mock provider tests

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Trigger the e2e testing workflow for a specific image version using the GitHub CLI.

```bash
gh workflow run e2e_mock_provider_tests -f imageVersion=<NEW_VERSION>
```

--------------------------------

### Sample Metrics Output

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/metrics.md

This is a sample of the metrics output you might see from the Secrets Store CSI Driver, including histogram and counter metrics.

```shell
# HELP k8s_secret_duration_sec Distribution of how long it took to sync k8s secret
# TYPE k8s_secret_duration_sec histogram
k8s_secret_duration_sec_bucket{os_type="linux",le="0.1"} 0
k8s_secret_duration_sec_bucket{os_type="linux",le="0.2"} 0
k8s_secret_duration_sec_bucket{os_type="linux",le="0.3"} 0
k8s_secret_duration_sec_bucket{os_type="linux",le="0.4"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="0.5"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="1"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="1.5"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="2"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="2.5"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="3"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="5"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="10"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="15"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="30"} 1
k8s_secret_duration_sec_bucket{os_type="linux",le="+Inf"} 1
k8s_secret_duration_sec_sum{os_type="linux"} 0.3115892
k8s_secret_duration_sec_count{os_type="linux"} 1
# HELP node_publish_total Total number of node publish calls
# TYPE node_publish_total counter
node_publish_total{os_type="linux",provider="azure"} 1
# HELP node_publish_error_total Total number of node publish calls with error
```

--------------------------------

### Generate image promoter manifest

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Command to update the image promoter manifest with the new image.

```bash
registry.k8s.io/images/k8s-staging-csi-secrets-store/generate.sh > registry.k8s.io/images/k8s-staging-csi-secrets-store/images.yaml
```

--------------------------------

### Create a version bump pull request

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Commands to create a new branch and commit version changes for a release.

```bash
git checkout <RELEASE_BRANCH>
git checkout -b bump-version-<NEW_VERSION>
git commit -m "release: bump version to <NEW_VERSION> in <RELEASE_BRANCH>"
git push <YOUR FORK>
```

--------------------------------

### Check for SecretProviderClass Not Found Error

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

This log snippet indicates that the `SecretProviderClass` referenced in the volume mount does not exist in the same namespace as the application pod. Verify the existence and namespace of your `SecretProviderClass`.

```bash
  Warning  FailedMount  3s (x4 over 6s)  kubelet, kind-control-plane  MountVolume.SetUp failed for volume "secrets-store-inline" : rpc error: code = Unknown desc = failed to get secretproviderclass default/azure, error: secretproviderclasses.secrets-store.csi.x-k8s.io "azure" not found
```

--------------------------------

### Commit and Push Changes for Release

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Commit changes with a release tag and push to your fork to create a pull request. Replace <NEWVERSION> with the actual version number.

```bash
git checkout -b release-<NEWVERSION> # i.e. release-0.3.0
git commit -a -s -m "release: update manifests and helm chart for <NEWVERSION>"
git push <YOUR FORK>
```

--------------------------------

### Configure Deployment Volume

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/usage.md

Update the deployment manifest to mount secrets using the secrets-store.csi.k8s.io driver.

```yaml
volumes:
  - name: secrets-store-inline
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "my-provider"
```

--------------------------------

### Port-forward and Access Metrics

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/metrics.md

Use kubectl port-forward to access the driver's metrics endpoint from localhost. Then, use curl to retrieve the metrics.

```bash
kubectl port-forward ds/csi-secrets-store -n kube-system 8095:8095 &
curl localhost:8095/metrics
```

--------------------------------

### Delete Old Resources (pre v0.0.18)

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/upgrades.md

Run these commands to remove the driver resources from the 'default' namespace after applying the new YAML files for versions v0.0.18 and later.

```bash
kubectl delete daemonset csi-secrets-store --namespace=default
kubectl delete daemonset csi-secrets-store-windows --namespace=default
kubectl delete serviceaccount secrets-store-csi-driver --namespace=default
```

--------------------------------

### Verify Secrets Store CSI Driver Pods

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/charts/secrets-store-csi-driver/templates/NOTES.txt

Run this command to check if the Secrets Store CSI Driver pods are running in the specified namespace.

```bash
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "sscd.name" . }}"
```

--------------------------------

### Volume Mount Configuration with SubPath

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/known-limitations.md

This configuration demonstrates the use of `subPath` for mounting a specific file within a volume. Using `subPath` can prevent secret updates from being reflected in the container.

```yaml
    volumeMounts:
    - mountPath: /app/spapi/settings.ini
      name: app-config
      subPath: settings.ini
...
  volumes:
  - csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: app-config
    name: app-config
```

--------------------------------

### Deploy Secrets Store CSI Driver using YAML

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/installation.md

Apply these YAML manifests to deploy the Secrets Store CSI Driver and its associated CRDs. Additional RBAC manifests are required for optional features like secret syncing, rotation, or token requests.

```bash
kubectl apply -f deploy/rbac-secretproviderclass.yaml
kubectl apply -f deploy/csidriver.yaml
kubectl apply -f deploy/secrets-store.csi.x-k8s.io_secretproviderclasses.yaml
kubectl apply -f deploy/secrets-store.csi.x-k8s.io_secretproviderclasspodstatuses.yaml
kubectl apply -f deploy/secrets-store-csi-driver.yaml
```

```bash
# If using the driver to sync secrets-store content as Kubernetes Secrets, deploy the additional RBAC permissions
# required to enable this feature
kubectl apply -f deploy/rbac-secretprovidersyncing.yaml
```

```bash
# If using the secret rotation feature, deploy the additional RBAC permissions
# required to enable this feature
kubectl apply -f deploy/rbac-secretproviderrotation.yaml
```

```bash
# If using the CSI Driver token requests feature (https://kubernetes-csi.github.io/docs/token-requests.html) to use
# pod/workload identity to request a token and use with providers
kubectl apply -f deploy/rbac-secretprovidertokenrequest.yaml
```

```bash
# [OPTIONAL] To deploy driver on windows nodes
kubectl apply -f deploy/secrets-store-csi-driver-windows.yaml
```

--------------------------------

### Mount Secrets from CSI Driver in a Pod

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/set-as-env-var.md

Configure a Pod to mount secrets using the Secrets Store CSI driver. The secrets are mounted to a specified path and can be accessed by containers.

```yaml
kind: Pod
apiVersion: v1
metadata:
  name: secrets-store-inline
spec:
  containers:
  - name: busybox
    image: registry.k8s.io/e2e-test-images/busybox:1.29
    command:
    - "/bin/sleep"
    - "10000"
    volumeMounts:
    - name: secrets-store01-inline
      mountPath: "/mnt/secrets-store"
      readOnly: true
    env:
    - name: SECRET_USERNAME
      valueFrom:
        secretKeyRef:
          name: foosecret
          key: username
  volumes:
  - name: secrets-store01-inline
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "azure-sync"

```

--------------------------------

### Display CSI Driver Pod Memory Usage

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/load-tests.md

Use this command to view the memory usage of CSI driver pods, sorted by memory consumption. This helps in identifying high-usage pods.

```bash
➜ kubectl top pods -l app=csi-secrets-store -n kube-system --sort-by=memory
NAME                      CPU(cores)   MEMORY(bytes)
csi-secrets-store-kd2bc   3m           54Mi
csi-secrets-store-wx6z9   3m           52Mi
csi-secrets-store-6gjqq   3m           52Mi
csi-secrets-store-knl5g   4m           52Mi
csi-secrets-store-9lzzn   4m           51Mi
```

--------------------------------

### Backup SecretProviderClass CRDs

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/upgrades.md

Before upgrading to v0.1.0, back up your SecretProviderClass resources to a YAML file. This is a precautionary measure in case of issues with the new CRD management hooks.

```bash
kubectl get secretproviderclass -A -o yaml > spc-all-backup.yaml
```

--------------------------------

### Define SecretProviderClass for Azure Key Vault

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/set-as-env-var.md

Use this to define how the CSI driver syncs secrets from Azure Key Vault. Specify Key Vault name, objects to sync, and optionally object versions.

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-sync
spec:
  provider: azure
  secretObjects:
  - secretName: foosecret
    type: Opaque
    labels:
      environment: "test"
    data:
    - objectName: secretalias
      key: username
  parameters:
    usePodIdentity: "false"
    keyvaultName: "$KEYVAULT_NAME"
    objects: |
      array:
        - |
          objectName: $SECRET_NAME
          objectType: secret
          objectAlias: secretalias
          objectVersion: $SECRET_VERSION
        - |
          objectName: $KEY_NAME
          objectType: key
          objectVersion: $KEY_VERSION
    tenantId: "tid"

```

--------------------------------

### Validate Mounted Secrets

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/usage.md

Verify that secrets are correctly mounted within the pod container.

```bash
kubectl exec secrets-store-inline -- ls /mnt/secrets-store/
foo
```

--------------------------------

### Define SecretProviderClass Resource

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/usage.md

Create a custom resource to specify the provider and parameters for secret retrieval.

```yaml
apiVersion: secrets-store.csi.k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-provider
spec:
  provider: vault                             # accepted provider options: akeyless or azure or vault or gcp
  parameters:                                 # provider-specific parameters
```

--------------------------------

### Configure SecretProviderClass for Azure Sync

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/sync-as-kubernetes-secret.md

Defines a SecretProviderClass with secretObjects to sync mounted content into a Kubernetes Secret.

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-sync
spec:
  provider: azure
  secretObjects:                                 # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
  - secretName: foosecret
    type: Opaque
    labels:
      environment: "test"
    data:
    - objectName: secretalias                    # name of the mounted content to sync. this could be the object name or object alias
      key: username
  parameters:
    usePodIdentity: "true"
    keyvaultName: "$KEYVAULT_NAME"               # the name of the KeyVault
    objects: |
      array:
        - |
          objectName: $SECRET_NAME
          objectType: secret                     # object types: secret, key or cert
          objectAlias: secretalias
          objectVersion: $SECRET_VERSION         # [OPTIONAL] object versions, default to latest if empty
        - |
          objectName: $KEY_NAME
          objectType: key
          objectVersion: $KEY_VERSION
    tenantId: "tid"                             # the tenant ID of the KeyVault
```

--------------------------------

### Verify Secrets Store CSI Driver pods

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/installation.md

Check the status of the Secrets Store CSI driver pods in the kube-system namespace to ensure they are running.

```bash
kubectl get po --namespace=kube-system
```

--------------------------------

### Upgrade Secrets Store CSI Driver using Helm

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/upgrades.md

Use this Helm command to upgrade the Secrets Store CSI Driver to the latest version. Ensure you replace NAMESPACE with the correct Kubernetes namespace.

```bash
helm upgrade csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace=NAMESPACE
```

--------------------------------

### Define SecretProviderClass Components

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/sync-as-kubernetes-secret.md

Basic structure for a SecretProviderClass resource using the secretObjects field.

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-provider
spec:
  provider: vault                             # accepted provider options: azure or vault or gcp
  secretObjects:                              # [OPTIONAL] SecretObject defines the desired state of synced K8s secret objects
  - data:
    - key: username                           # data field to populate
      objectName: foo1                        # name of the mounted content to sync. this could be the object name or the object alias
    secretName: foosecret                     # name of the Kubernetes Secret object
    type: Opaque                              # type of the Kubernetes Secret object e.g. Opaque, kubernetes.io/tls
```

--------------------------------

### Cherry-pick Commit to Release Branch

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md

Cherry-pick a commit to the specified release branch. Replace <user name>, <release branch>, and <pr number> with appropriate values.

```bash
export GITHUB_USER=<user name>
hack/cherry_pick_pull.sh upstream/<release branch> <pr number>
```

--------------------------------

### Remove RBAC resources for older rotation controller

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/upgrades.md

If deploying via YAML and upgrading from a version prior to v1.6.0, delete the old rotation-specific RBAC resources. These are no longer needed with the new mechanism.

```bash
kubectl delete clusterrole secretproviderrotation
kubectl delete clusterrolebinding secretproviderrotation
kubectl delete clusterrole secretprovidertokenrequest
kubectl delete clusterrolebinding secretprovidertokenrequest
```

--------------------------------

### Configure Max Receive Message Size for gRPC

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/troubleshooting.md

If you encounter `grpc: received message larger than max` errors, you can increase the maximum gRPC receive message size by configuring the `--max-call-recv-msg-size` argument for the `secrets-store` container. Be mindful of potential increases in memory consumption.

```bash
--max-call-recv-msg-size=<size in bytes>
```

--------------------------------

### Update Helm Chart Repositories

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/upgrades.md

Update your Helm repositories to point to the new chart repository URL for the Secrets Store CSI Driver. This is necessary for versions prior to v0.3.0.

```bash
helm repo rm secrets-store-csi-driver
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
helm repo update
```

--------------------------------

### Label Node Publish Secret Reference

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/load-tests.md

Label existing node publish secret references with `secrets-store.csi.k8s.io/used=true` to enable filtered secret watch. This is crucial for optimizing secret caching when secret rotation is enabled.

```bash
kubectl label secret <node publish secret ref name> secrets-store.csi.k8s.io/used=true
```

--------------------------------

### Node Publish Error Metrics

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/metrics.md

These metrics track errors encountered during the node publish operation, categorized by error type, operating system, and provider. They are useful for diagnosing issues related to secret provisioning on nodes.

```text
# TYPE node_publish_error_total counter
node_publish_error_total{error_type="ProviderBinaryNotFound",os_type="linux",provider="azure"} 2
node_publish_error_total{error_type="SecretProviderClassNotFound",os_type="linux",provider=""} 4
```

--------------------------------

### Verify Secrets Store CSI Driver CRDs

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/installation.md

List the deployed Custom Resource Definitions (CRDs) to confirm that the necessary CRDs for the Secrets Store CSI Driver are present.

```bash
kubectl get crd
```

--------------------------------

### Kubernetes Secret Sync Metrics

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/metrics.md

This metric tracks the total number of Kubernetes secrets that have been successfully synced by the driver, categorized by operating system and provider. It indicates the driver's effectiveness in synchronizing external secrets into Kubernetes.

```text
# HELP sync_k8s_secret_total Total number of k8s secrets synced
# TYPE sync_k8s_secret_total counter
sync_k8s_secret_total{os_type="linux",provider="azure"} 1
```

--------------------------------

### SecretProviderClass CRD Structure

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/concepts.md

Defines the basic structure of a SecretProviderClass custom resource, including metadata and spec for provider configuration.

```yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: my-provider
spec:
  provider: vault                             # accepted provider options: akeyless or azure or vault or gcp
  parameters:                                 # provider-specific parameters
```

--------------------------------

### Node Unpublish Metrics

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/topics/metrics.md

This metric counts the total number of node unpublish calls made to the driver, segmented by operating system. It helps in monitoring the cleanup process of secrets from nodes.

```text
# HELP node_unpublish_total Total number of node unpublish calls
# TYPE node_unpublish_total counter
node_unpublish_total{os_type="linux"} 1
```

--------------------------------

### Label Node Publish Secret References

Source: https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/book/src/getting-started/upgrades.md

For versions v0.1.0 and later, label existing nodePublishSecretRef Kubernetes Secrets with 'secrets-store.csi.k8s.io/used=true'. This is required for the filtered watch feature to prevent rotation failures.

```bash
kubectl label secret <node publish secret ref name> secrets-store.csi.k8s.io/used=true
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.