v1.14.6/website/content/docs/platform/k8s/csi/configurations.mdx - hashicorp/vault - Git at Google

 ---
 layout: docs
 page_title: Vault CSI Provider Configurations
 description: This section documents the configurables for the Vault CSI Provider.
 ---

 # Command line arguments

 The following command line arguments are supported by the Vault CSI provider.
 Most settings support being set by, in ascending order of precedence:

 - Environment variables
 - Command line arguments
 - Secret Provider Class parameters

 If installing via the helm chart, they can be set using e.g.
 `--set "csi.extraArgs={-debug=true}"`.

 - `-cache-size` `(int: 1000)` - Set the maximum number of Vault tokens that will
   be cached in-memory. One Vault token will be stored for each pod on the same
   node that mounts secrets. Setting to 0 will disable the cache and force each
   volume mount request to reauthenticate to Vault.

 - `-debug` `(bool: false)` - Set to true to enable debug level logging.

 - `-endpoint` `(string: "/tmp/vault.sock")` - Path to unix socket on which the
   provider will listen for gRPC calls from the driver.

 - `-health-addr` `(string: ":8080")` - The address of the HTTP listener
   for reporting health.

 - `-hmac-secret-name` `(string: "vault-csi-provider-hmac-key")` - Configure the
   Kubernetes secret name that the provider creates to store an HMAC key for
   generating secret version hashes.

 - `-vault-addr` `(string: "https://127.0.0.1:8200")` - Default address
   for connecting to Vault. Can also be specified via the `VAULT_ADDR` environment
   variable. **Note:** It is highly recommended to only set the Vault address when
   installing the helm chart. The helm chart will install Vault Agent as a sidecar
   to the Vault CSI Provider for caching and renewals, but setting `-vault-addr`
   here will cause the Vault CSI Provider to bypass the Agent's cache.

 - `-vault-mount` `(string: "kubernetes")` - Default Vault mount path
   for Kubernetes authentication. Can be overridden per Secret Provider Class
   object.

 - `-vault-namespace` `(string: "")` - (v1.1.0+) Default Vault namespace for Vault
   requests. Can also be specified via the `VAULT_NAMESPACE` environment variable.

 - `-vault-tls-ca-cert` `(string: "")` - (v1.1.0+) Path on disk to a single
   PEM-encoded CA certificate to trust for Vault. Takes precendence over
   `-vault-tls-ca-directory`. Can also be specified via the `VAULT_CACERT`
   environment variable.

 - `-vault-tls-ca-directory` `(string: "")` - (v1.1.0+) Path on disk to a
   directory of PEM-encoded CA certificates to trust for Vault. Can also be
   specified via the `VAULT_CAPATH` environment variable.

 - `-vault-tls-server-name` `(string: "")` - (v1.1.0+) Name to use as the SNI
   host when connecting to Vault via TLS. Can also be specified via the
   `VAULT_TLS_SERVER_NAME` environment variable.

 - `-vault-tls-client-cert` `(string: "")` - (v1.1.0+) Path on disk to a
   PEM-encoded client certificate for mTLS communication with Vault. If set,
   also requires `-vault-tls-client-key`. Can also be specified via the
   `VAULT_CLIENT_CERT` environment variable.

 - `-vault-tls-client-key` `(string: "")` - (v1.1.0+) Path on disk to a
   PEM-encoded client key for mTLS communication with Vault. If set, also
   requires `-vault-tls-client-cert`. Can also be specified via the
   `VAULT_CLIENT_KEY` environment variable.

 - `-vault-tls-skip-verify` `(bool: false)` - (v1.1.0+) Disable verification of
   TLS certificates. Can also be specified via the `VAULT_SKIP_VERIFY` environment
   variable.

 - `-version` `(bool: false)` - print version information and exit.


 # Secret provider class parameters

 The following parameters are supported by the Vault provider. Each parameter is
 an entry under `spec.parameters` in a SecretProviderClass object. The full
 structure is illustrated in the [examples](/vault/docs/platform/k8s/csi/examples).

 - `roleName` `(string: "")` - Name of the role to be used during login with Vault.

 - `vaultAddress` `(string: "")` - The address of the Vault server. **Note:** It is
   highly recommended to only set the Vault address when installing the helm chart.
   The helm chart will install Vault Agent as a sidecar to the Vault CSI Provider
   for caching and renewals, but setting `vaultAddress` here will cause the Vault
   CSI Provider to bypass the Agent's cache.

 - `vaultNamespace` `(string: "")` - The Vault [namespace](/vault/docs/enterprise/namespaces) to use.

 - `vaultSkipTLSVerify` `(string: "false")` - When set to true, skips verification of the Vault server
   certificate. Setting this to true is not recommended for production.

 - `vaultCACertPath` `(string: "")` - The path on disk where the Vault CA certificate can be found
   when verifying the Vault server certificate.

 - `vaultCADirectory` `(string: "")` - The directory on disk where the Vault CA certificate can be found
   when verifying the Vault server certificate.

 - `vaultTLSClientCertPath` `(string: "")` - The path on disk where the client certificate can be found
   for mTLS communications with Vault.

 - `vaultTLSClientKeyPath` `(string: "")` - The path on disk where the client key can be found
   for mTLS communications with Vault.

 - `vaultTLSServerName` `(string: "")` - The name to use as the SNI host when connecting via TLS.

 - `vaultAuthMountPath` `(string: "kubernetes")` - The name of the auth mount used for login.
   Can be a Kubernetes or JWT auth mount. Mutually exclusive with `vaultKubernetesMountPath`.

 - `vaultKubernetesMountPath` `(string: "kubernetes")` - The name of the auth mount used for login.
   Can be a Kubernetes or JWT auth mount. Mutually exclusive with `vaultAuthMountPath`.

 - `audience` `(string: "")` - Specifies a custom audience for the requesting pod's service account token,
   generated using the
   [TokenRequest API](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/#TokenRequestSpec).
   The resulting token is used to authenticate to Vault, so if you specify an
   [audience](/vault/api-docs/auth/kubernetes#audience) for your Kubernetes auth
   role, it must match the audience specified here. If not set, the token audiences will default to
   the Kubernetes cluster's default API audiences.

 - `objects` `(array)` - An array of secrets to retrieve from Vault.

   - `objectName` `(string: "")` - The alias of the object which can be referenced within the secret provider class and
   the name of the secret file.

   - `method` `(string: "GET")` - The type of HTTP request. Supported values include "GET" and "PUT".

   - `secretPath` `(string: "")` - The path in Vault where the secret is located.
     For secrets that are retrieved via HTTP GET method, the `secretPath` can include optional URI parameters,
     for example, the [version of the KV2 secret](/vault/api-docs/secret/kv/kv-v2#read-secret-version):

     ```yaml
     objects: |
       - objectName: "app-secret"
         secretPath: "secret/data/test?version=1"
         secretKey: "password"
     ```

   - `secretKey` `(string: "")` - The key in the Vault secret to extract. If omitted, the whole response from Vault will be written as JSON.

   - `filePermission` `(integer: 0o644)` - The file permissions to set for this secret's file.

   - `encoding` `(string: "utf-8")` - The encoding of the secret value. Supports decoding `utf-8` (default), `hex`, and `base64` values.

   - `secretArgs` `(map: {})` - Additional arguments to be sent to Vault for a specific secret. Arguments can vary
     for different secret engines. For example:

     ```yaml
     secretArgs:
       common_name: 'test.example.com'
       ttl: '24h'
     ```

     ~> `secretArgs` are sent as part of the HTTP request body. Therefore, they are only effective for HTTP PUT/POST requests, for instance,
         the [request used to generate a new certificate](/vault/api-docs/secret/pki#generate-certificate).
         To supply additional parameters for secrets retrieved via HTTP GET, include optional URI parameters in [`secretPath`](#secretpath).
	---
	layout: docs
	page_title: Vault CSI Provider Configurations
	description: This section documents the configurables for the Vault CSI Provider.
	---

	# Command line arguments

	The following command line arguments are supported by the Vault CSI provider.
	Most settings support being set by, in ascending order of precedence:

	- Environment variables
	- Command line arguments
	- Secret Provider Class parameters

	If installing via the helm chart, they can be set using e.g.
	`--set "csi.extraArgs={-debug=true}"`.

	- `-cache-size` `(int: 1000)` - Set the maximum number of Vault tokens that will
	be cached in-memory. One Vault token will be stored for each pod on the same
	node that mounts secrets. Setting to 0 will disable the cache and force each
	volume mount request to reauthenticate to Vault.

	- `-debug` `(bool: false)` - Set to true to enable debug level logging.

	- `-endpoint` `(string: "/tmp/vault.sock")` - Path to unix socket on which the
	provider will listen for gRPC calls from the driver.

	- `-health-addr` `(string: ":8080")` - The address of the HTTP listener
	for reporting health.

	- `-hmac-secret-name` `(string: "vault-csi-provider-hmac-key")` - Configure the
	Kubernetes secret name that the provider creates to store an HMAC key for
	generating secret version hashes.

	- `-vault-addr` `(string: "https://127.0.0.1:8200")` - Default address
	for connecting to Vault. Can also be specified via the `VAULT_ADDR` environment
	variable. Note: It is highly recommended to only set the Vault address when
	installing the helm chart. The helm chart will install Vault Agent as a sidecar
	to the Vault CSI Provider for caching and renewals, but setting `-vault-addr`
	here will cause the Vault CSI Provider to bypass the Agent's cache.

	- `-vault-mount` `(string: "kubernetes")` - Default Vault mount path
	for Kubernetes authentication. Can be overridden per Secret Provider Class
	object.

	- `-vault-namespace` `(string: "")` - (v1.1.0+) Default Vault namespace for Vault
	requests. Can also be specified via the `VAULT_NAMESPACE` environment variable.

	- `-vault-tls-ca-cert` `(string: "")` - (v1.1.0+) Path on disk to a single
	PEM-encoded CA certificate to trust for Vault. Takes precendence over
	`-vault-tls-ca-directory`. Can also be specified via the `VAULT_CACERT`
	environment variable.

	- `-vault-tls-ca-directory` `(string: "")` - (v1.1.0+) Path on disk to a
	directory of PEM-encoded CA certificates to trust for Vault. Can also be
	specified via the `VAULT_CAPATH` environment variable.

	- `-vault-tls-server-name` `(string: "")` - (v1.1.0+) Name to use as the SNI
	host when connecting to Vault via TLS. Can also be specified via the
	`VAULT_TLS_SERVER_NAME` environment variable.

	- `-vault-tls-client-cert` `(string: "")` - (v1.1.0+) Path on disk to a
	PEM-encoded client certificate for mTLS communication with Vault. If set,
	also requires `-vault-tls-client-key`. Can also be specified via the
	`VAULT_CLIENT_CERT` environment variable.

	- `-vault-tls-client-key` `(string: "")` - (v1.1.0+) Path on disk to a
	PEM-encoded client key for mTLS communication with Vault. If set, also
	requires `-vault-tls-client-cert`. Can also be specified via the
	`VAULT_CLIENT_KEY` environment variable.

	- `-vault-tls-skip-verify` `(bool: false)` - (v1.1.0+) Disable verification of
	TLS certificates. Can also be specified via the `VAULT_SKIP_VERIFY` environment
	variable.

	- `-version` `(bool: false)` - print version information and exit.


	# Secret provider class parameters

	The following parameters are supported by the Vault provider. Each parameter is
	an entry under `spec.parameters` in a SecretProviderClass object. The full
	structure is illustrated in the [examples](/vault/docs/platform/k8s/csi/examples).

	- `roleName` `(string: "")` - Name of the role to be used during login with Vault.

	- `vaultAddress` `(string: "")` - The address of the Vault server. Note: It is
	highly recommended to only set the Vault address when installing the helm chart.
	The helm chart will install Vault Agent as a sidecar to the Vault CSI Provider
	for caching and renewals, but setting `vaultAddress` here will cause the Vault
	CSI Provider to bypass the Agent's cache.

	- `vaultNamespace` `(string: "")` - The Vault [namespace](/vault/docs/enterprise/namespaces) to use.

	- `vaultSkipTLSVerify` `(string: "false")` - When set to true, skips verification of the Vault server
	certificate. Setting this to true is not recommended for production.

	- `vaultCACertPath` `(string: "")` - The path on disk where the Vault CA certificate can be found
	when verifying the Vault server certificate.

	- `vaultCADirectory` `(string: "")` - The directory on disk where the Vault CA certificate can be found
	when verifying the Vault server certificate.

	- `vaultTLSClientCertPath` `(string: "")` - The path on disk where the client certificate can be found
	for mTLS communications with Vault.

	- `vaultTLSClientKeyPath` `(string: "")` - The path on disk where the client key can be found
	for mTLS communications with Vault.

	- `vaultTLSServerName` `(string: "")` - The name to use as the SNI host when connecting via TLS.

	- `vaultAuthMountPath` `(string: "kubernetes")` - The name of the auth mount used for login.
	Can be a Kubernetes or JWT auth mount. Mutually exclusive with `vaultKubernetesMountPath`.

	- `vaultKubernetesMountPath` `(string: "kubernetes")` - The name of the auth mount used for login.
	Can be a Kubernetes or JWT auth mount. Mutually exclusive with `vaultAuthMountPath`.

	- `audience` `(string: "")` - Specifies a custom audience for the requesting pod's service account token,
	generated using the
	[TokenRequest API](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/#TokenRequestSpec).
	The resulting token is used to authenticate to Vault, so if you specify an
	[audience](/vault/api-docs/auth/kubernetes#audience) for your Kubernetes auth
	role, it must match the audience specified here. If not set, the token audiences will default to
	the Kubernetes cluster's default API audiences.

	- `objects` `(array)` - An array of secrets to retrieve from Vault.

	- `objectName` `(string: "")` - The alias of the object which can be referenced within the secret provider class and
	the name of the secret file.

	- `method` `(string: "GET")` - The type of HTTP request. Supported values include "GET" and "PUT".

	- `secretPath` `(string: "")` - The path in Vault where the secret is located.
	For secrets that are retrieved via HTTP GET method, the `secretPath` can include optional URI parameters,
	for example, the [version of the KV2 secret](/vault/api-docs/secret/kv/kv-v2#read-secret-version):

	```yaml
	objects: \|
	- objectName: "app-secret"
	secretPath: "secret/data/test?version=1"
	secretKey: "password"
	```

	- `secretKey` `(string: "")` - The key in the Vault secret to extract. If omitted, the whole response from Vault will be written as JSON.

	- `filePermission` `(integer: 0o644)` - The file permissions to set for this secret's file.

	- `encoding` `(string: "utf-8")` - The encoding of the secret value. Supports decoding `utf-8` (default), `hex`, and `base64` values.

	- `secretArgs` `(map: {})` - Additional arguments to be sent to Vault for a specific secret. Arguments can vary
	for different secret engines. For example:

	```yaml
	secretArgs:
	common_name: 'test.example.com'
	ttl: '24h'
	```

	~> `secretArgs` are sent as part of the HTTP request body. Therefore, they are only effective for HTTP PUT/POST requests, for instance,
	the [request used to generate a new certificate](/vault/api-docs/secret/pki#generate-certificate).
	To supply additional parameters for secrets retrieved via HTTP GET, include optional URI parameters in [`secretPath`](#secretpath).