Skip to content

Mounting AWS Secrets as Environment Variables via Secrets Store CSI Driver

Kubernetes CSI

By default, the AWS Secrets Store CSI Driver mounts secrets from AWS Secrets Manager as volume-attached files inside containers.

However, many legacy and cloud-native applications expect secrets (such as database credentials or API tokens) to be passed as environment variables.

By utilizing spec.secretObjects in the SecretProviderClass, the CSI driver automatically creates a synchronized native Kubernetes Secret whenever a pod mounts the volume, allowing you to consume the secrets as standard env variables.

📁 Source Code: Aws-Eks-SecretsManager

SecretProviderClass Configuration

secret-provider-class.yaml 

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: aws-secret-to-k8s-secret
  namespace: default
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "MySecret"
        objectType: "secretsmanager"
        jmesPath:
          - path: "username"
            objectAlias: "DB_USER"
          - path: "password"
            objectAlias: "DB_PASS"
  secretObjects:
    - secretName: db-k8s-secret
      type: Opaque
      data:
        - objectName: "DB_USER"
          key: "username"
        - objectName: "DB_PASS"
          key: "password"

Pod Manifest Mounting Secret as Environment Variable

pod.yaml 

apiVersion: v1
kind: Pod
metadata:
  name: demo-app
  namespace: default
spec:
  serviceAccountName: nginx-deployment-sa
  containers:
    - name: app
      image: nginx:alpine
      env:
        - name: DATABASE_USER
          valueFrom:
            secretKeyRef:
              name: db-k8s-secret
              key: username
        - name: DATABASE_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-k8s-secret
              key: password
      volumeMounts:
        - name: secrets-store-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "aws-secret-to-k8s-secret"

Volume Mount Required

The Secrets Store CSI Driver creates the Kubernetes Secret only when the volume is actively mounted by at least one running Pod.