csi-driver

csi-driver is a Container Storage Interface (CSI) driver plugin for Kubernetes to work along cert-manager. The goal for this plugin is to facilitate requesting and mounting certificate key pairs to pods seamlessly. This is useful for facilitating mTLS, or otherwise securing connections of pods with guaranteed present certificates whilst having all of the features that cert-manager provides.

Why a CSI Driver?

• Ensure private keys never leave the node and are never sent over the network. All private keys are stored locally on the node.
• Unique key and certificate per application replica with a grantee to be present on application run time.
• Reduce resource management overhead by defining certificate request spec in-line of the Kubernetes Pod template.
• Automatic renewal of certificates based on expiry of each individual certificate.
• Keys and certificates are destroyed during application termination.
• Scope for extending plugin behaviour with visibility on each replica's certificate request and termination.

Documentation

Please follow the documentation at cert-manager.io for installing and using csi-driver.

Release Process

There is a semi-automated release process for csi-driver. When you create a Git tag with a tagname that has a v prefix and push it to GitHub it will trigger the release workflow.

This will:

1. Create and push a Docker image to quay.io/jetstack/cert-manager-csi-driver:${{ github.ref_name }}
2. Create a Helm chart
3. Create a draft GitHub release with the Helm chart file attached and containing a reference to the Docker image.

To perform a release:

1. Create and push a Git tag

   export VERSION=v0.5.0-alpha.0
   git tag --annotate --message="Release ${VERSION}" "${VERSION}"
   git push origin "${VERSION}"

2. Wait for the release workflow to succeed and if successful visit the draft release page to download the attached Helm chart attachment.

3. Create a PR in the jetstack/jetstack-charts repository on GitHub, containing the Helm chart file that is attached to the draft GitHub release. This is only currently possible for maintainers inside Venafi, but will be changed in the future.

4. Wait for the PR to be merged and verify that the Helm chart is available from https://charts.jetstack.io.

5. Visit the releases page, edit the draft release, click "Generate release notes", and publish the release.