hub / github.com/cert-manager/csi-driver-spiffe
github.com/cert-manager/csi-driver-spiffe @v0.14.0
Chat with this repo
140 symbols
545 edges
42 files
81 documented · 58%
● updated 1d agov0.14.0 · 2026-06-17★ 864 open issues
What it actually does AI analysis from the code graph — generated when you open this
loading…
README
csi-driver-spiffe
csi-driver-spiffe is a Container Storage Interface (CSI) driver plugin for Kubernetes, designed to work alongside cert-manager.
It transparently delivers SPIFFE SVIDs (in the form of X.509 certificate key pairs) to mounting Kubernetes Pods.
The end result is that any and all Pods running in Kubernetes can securely request a SPIFFE identity document from a Trust Domain with minimal configuration.
These documents in turn have the following properties:
- automatically renewed ✔️
- private key never leaves the node's virtual memory ✔️
- each Pod's document is unique ✔️
- the document shares the same life cycle as the Pod and is destroyed on Pod termination ✔️
...
volumeMounts:
- mountPath: "/var/run/secrets/spiffe.io"
name: spiffe
volumes:
- name: spiffe
csi:
driver: spiffe.csi.cert-manager.io
readOnly: true
SPIFFE documents can then be used by Pods for mutual TLS (mTLS) or other authentication within their Trust Domain.
Documentation
Please follow the documentation at cert-manager.io for installing and using csi-driver-spiffe.
Release Process
The release process is documented in RELEASE.md.
Extension points exported contracts — how you extend this code
IssuerCleanupFunc (FuncType)
IssuerCleanupFunc is called to clean up issuer related resources after a test. Any returned cleanup function should alwa
test/e2e/util/util.go
Interface (Interface)
Interface is the Evaluator which is used for determining whether a CertificateRequest should be approved or denied.
internal/approver/evaluator/evaluator.go
Interface (Interface)
Interface provides the current runtime configuration.
internal/csi/runtimeconfig/runtimeconfig.go
RegisterFunc (FuncType)
(no doc)
internal/flags/flags.go
Interface (Interface)
Interface provide the root PEM encoded X.509 Certificate Authority certificates of the trust domain. Consumers can subsc
internal/csi/rootca/rootca.go
Core symbols most depended-on inside this repo
Context
called by 84
test/e2e/framework/framework.go
Client
called by 69
test/e2e/framework/framework.go
Config
called by 19
internal/csi/runtimeconfig/runtimeconfig.go
ReadCertFromMountPath
called by 11
test/e2e/util/util.go
WaitForPodReady
called by 10
test/e2e/util/util.go
Run
called by 10
internal/csi/driver/driver.go
Add
called by 9
internal/flags/flags.go
genCSRPEM
called by 5
test/e2e/suite/approval/approval.go
Shape
Languages
Go100%
Modules by API surface
test/e2e/util/util.go12 symbols
test/e2e/framework/framework.go9 symbols
internal/flags/flags.go8 symbols
internal/csi/app/options/options.go8 symbols
internal/approver/evaluator/extensions_test.go8 symbols
internal/csi/driver/driver.go7 symbols
test/e2e/framework/config/config.go6 symbols
internal/csi/runtimeconfig/runtimeconfig.go6 symbols
internal/csi/runtimeconfig/configmap.go6 symbols
internal/csi/rootca/file.go6 symbols
internal/approver/evaluator/evaluator.go6 symbols
internal/approver/app/options/options.go6 symbols
For agents
$ claude mcp add csi-driver-spiffe \
-- python -m otcore.mcp_server <graph>