Support multiple Azure Key Vault instances as fallback about secrets-store-csi-driver-provider-azure HOT 6 OPEN

Linking the slack thread here for future reference.

from secrets-store-csi-driver-provider-azure.

Writing down recommendations from the slack thread:

• Use the upcoming secret sync controller to have full offline support (i.e. tolerate any form of failure, not just one AKV region having an issue)
• Write a generic provider that can multiplex across N providers (which could be different types altogether)
• Work with sig-storage folks to expand CSI drivers to support optional volume mounts so that N providers can be used to provide the same secrets

from secrets-store-csi-driver-provider-azure.

This is the slack thread in sig-storage.

I'd like to respectfuly say, all the options seem as: "do it from your side or go to another place".
It is a fact that the component isn't resilient to any kind of disruption, which can be a no-go for productive scenarios.

Not storing the secrets in k8s API is the main reason for using the csi. Storing the secrets in k8s API instead of a fallback/failover/justanothercall it's already managed by other 3rd parties and it's quite less secure than using CSI.

from secrets-store-csi-driver-provider-azure.

Hi again ✋ !
I've presented the topic in the SIG-Storage meeting (Jan 25th) where there's been a SIG lead and the conclusion from the SIG is that it's the CSI-drive (this component) who has to handle the failures and high availability features as making the volume optional, only moves the problem from the k8s layer to the application layer.

Is it now something open to discuss or doing it by myself the only option that's left?

Currently, the component isn't resilient to Azure Key Vault failures and it's a single point of failure indeed, which is a problem at least for us (and that's why we are willing to contribute with this)

from secrets-store-csi-driver-provider-azure.

Hello @enj !
Is there any update realted with this?

from secrets-store-csi-driver-provider-azure.

Hello @enj !
Have you had an opportunity to see this by chance?

from secrets-store-csi-driver-provider-azure.