From 6889e2585521f71bd74c720ed66223ea464bf42d Mon Sep 17 00:00:00 2001 From: Vanda ILLYES Date: Thu, 3 Sep 2026 17:58:07 +0200 Subject: [PATCH 01/11] feat(secret-manager): add csi provider on K8s --- ...secret-manager-csi-provider-kubernetes.mdx | 273 ++++++++++++++++++ pages/secret-manager/menu.ts | 4 + 2 files changed, 277 insertions(+) create mode 100644 pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx new file mode 100644 index 0000000000..853804ed9b --- /dev/null +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -0,0 +1,273 @@ +--- +title: Deploying the Scaleway Secret Manager CSI provider on Kubernetes +description: Learn how to install the Scaleway Secret Manager provider for Secrets Store CSI Driver on Kubernetes and mount secrets as volumes in your pods. +tags: secret-manager kubernetes csi secrets helm +dates: + validation: 2026-09-03 + posted: 2026-09-04 +categories: + - secret-manager +--- +import Requirements from '@macros/iam/requirements.mdx' + +[Scaleway Secret Manager](/secret-manager/) is the managed service that lets you store and manage your secrets (API keys, passwords, certificates, etc.) in a secure and centralized way. + +The [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) is a [Kubernetes CSI](https://kubernetes-csi.github.io/docs/) driver that enables you to mount secrets from external secret stores as volumes in your Kubernetes pods. + +The **Scaleway Secret Manager provider for Secrets Store CSI Driver** (also called "the provider" in the remainder of this document) connects these two together: it allows you to get secrets stored in Scaleway Secret Manager and use the Secrets Store CSI Driver interface to mount them directly into your Kubernetes pods as files. + +Unlike [External Secrets](https://external-secrets.io), which materializes external secrets as Kubernetes `Secret` objects managed by an operator, the Scaleway Secret Manager provider mounts the secret contents directly into pods through the CSI volume interface, without creating intermediary Kubernetes secrets. + +In this tutorial, you will learn how to install this provider on your Kubernetes cluster, define which secrets to mount, and access them from your application pods. + + + +- A Scaleway account logged into the [console](https://console.scaleway.com) +- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization +- A Kubernetes cluster, for example a [Kubernetes Kapsule](/kubernetes/concepts/#kubernetes-kapsule) cluster, with `kubectl` configured to access it +- Installed [helm](https://helm.sh/), the Kubernetes package manager, on your local machine (version 3 or later) +- At least one secret already [created in Scaleway Secret Manager](/secret-manager/quickstart/) + +If you plan to use a dedicated application or service account with a custom IAM policy, the minimum set of permissions required is: + +- `SecretManagerReadOnly` +- `SecretManagerSecretAccess` + +## Install the Secrets Store CSI Driver + +The Scaleway Secret Manager provider is an add-on to the Secrets Store CSI Driver, so the driver must be installed in your cluster first. The easiest way to install it is with Helm: + +```bash +helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts +helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace kube-system +``` + +See the official [Secrets Store CSI Driver installation documentation](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation.html) for alternative installation methods and options. + +## Install the Scaleway Secret Manager provider + +### Install using Helm + +The recommended installation method is via Helm 3: + +```bash +helm repo add scaleway https://helm.scw.cloud/ +helm repo update +helm upgrade --install scaleway-secrets-store-csi --namespace kube-system scaleway/scaleway-secrets-store-csi +``` + +The full set of configurable values is available in the [Helm chart `values.yaml` of the Scaleway Secrets Store CSI](https://github.com/scaleway/helm-charts/blob/master/charts/scaleway-secrets-store-csi/values.yaml). + +### Install using kubectl + +You can also install the provider using the deployment configuration provided in the [`deployment` folder](https://github.com/scaleway/scaleway-secrets-store-csi/tree/main/deployment) of the [Scaleway Secrets Store CSI repository](https://github.com/scaleway/scaleway-secrets-store-csi): + +```bash +kubectl apply -n kube-system -f https://raw.githubusercontent.com/scaleway/scaleway-secrets-store-csi/main/deployment/secrets-store-csi-driver-provider-scw.yaml +``` + +This installs the provider as a `DaemonSet` (so it runs on every node) together with its `ServiceAccount`, `ClusterRole`, and `ClusterRoleBinding`. + +## Create the Scaleway credentials Secret + +To authenticate to Scaleway, create a Kubernetes Secret containing your Scaleway API credentials (that is, the access key and secret key of your API key). Remember to replace placeholders `` and `` with your actual values. + +See the [IAM documentation](/iam/how-to/create-api-keys/) for details on how to create an API key. + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: scaleway-credentials + namespace: default +type: Opaque +stringData: + accessKey: "" + secretKey: "" +``` + + +The provider does not support authentication with a Kubernetes Service Account yet. + + +## Create a SecretProviderClass + +A `SecretProviderClass` defines which secrets from Scaleway Secret Manager should be mounted. Create a `SecretProviderClass` in the namespace where your application runs, referencing the credentials Secret created in the previous step. Remember to replace the placeholders with your actual values. + +```yaml +apiVersion: secrets-store.csi.x-k8s.io/v1 +kind: SecretProviderClass +metadata: + name: scaleway-provider + namespace: default +spec: + provider: scaleway + parameters: + apiURL: "https://api.scaleway.com" + insecure: "false" + defaultOrganizationID: "<573e26e8-45b7-4859-aa81-547de6e9acff>" + defaultProjectID: "<6a4027ce-58c3-4adb-9b69-7ff6e1f317d2>" + defaultRegion: "fr-par" + objects: | + - secretID: "" + revision: "latest_enabled" + targetPath: "" + - projectID: "" + secretPath: "" + secretName: "" + revision: "latest_enabled" +``` + +The `parameters` section supports the following settings: + +| Parameter | Description | Default | +|-----------|-------------|---------| +| `apiURL` | The Scaleway API URL | `https://api.scaleway.com` | +| `insecure` | Set to `"true"` to disable TLS verification (for testing against a local API) | `"false"` | +| `defaultOrganizationID` | Default Organization ID used when no Project is specified | none | +| `defaultProjectID` | Default Project ID containing the secrets | none | +| `defaultRegion` | The [region](/secret-manager/concepts/#region) of your secrets | none (required) | +| `objects` | Contains the definition of each secret to mount (YAML), either by **Secret ID** or by **Secret Path** (see section [Access secrets](#access-secrets)). | none (required) | + +## Access secrets + +### Access a secret by secret ID + +To access a secret version by its ID, specify the `secretID` field. Remember to replace the placeholders with your actual values. + +```yaml +objects: | + - secretID: "" + revision: "latest_enabled" + targetPath: "" +``` + +Where: + +- `secretID`: The UUID of the secret +- `revision`: The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. (optional, defaults to `latest_enabled`) +- `targetPath`: The relative path where the secret will be mounted + +### Access a secret by secret path + +To access a secret version by its path, specify the `secretPath` and `secretName` fields. Remember to replace the placeholders with your actual values. + +```yaml +objects: | + - projectID: "" + secretPath: "" + secretName: "" + revision: "latest_enabled" +``` + +**Where:** + +- `projectID`: The project ID containing the secret (optional, defaults to `defaultProjectID` or `defaultOrganizationID`) +- `secretPath`: The absolute path to the secret folder +- `secretName`: The name of the secret +- `revision`: The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. (optional, defaults to `latest_enabled`) +- `targetPath`: The relative path where the secret will be mounted (optional, defaults to `secretPath/secretName`) + + +A secret must be specified either by ID or by path, but not both. If you specify an ID, the path fields are ignored. + + +## Mount secrets in a Pod + +Now that the `SecretProviderClass` is defined, mount the secrets in your application Pod by referencing it through a CSI volume. Create a Pod similar to the following: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-secret-pod + namespace: default +spec: + containers: + - name: busybox + image: busybox + command: ["sleep", "infinity"] + volumeMounts: + - name: secrets-store + mountPath: "/mnt/secrets" + readOnly: true + volumes: + - name: secrets-store + csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: scaleway-provider + nodePublishSecretRef: + name: scaleway-credentials +``` + +The `csi` volume: +- uses the `secrets-store.csi.k8s.io` driver +- points to the `SecretProviderClass` via the `secretProviderClass` volume attribute +- references the credentials Secret created earlier through `nodePublishSecretRef` + +Once the Pod is running, the secrets are mounted as files under the `mountPath`. You can verify that the secrets are accessible inside the Pod: + +```bash +kubectl exec test-secret-pod -- ls -l /mnt/secrets +kubectl exec test-secret-pod -- cat /mnt/secrets/my-secret +``` + + +Mounted secrets are written to the node's filesystem when the Pod is scheduled. Changes made to the secret in Secret Manager (for example, a new revision) are not reflected automatically in a running Pod; recreate or restart the Pod to pick up the latest revision. + + +## Uninstall the provider + +1. Delete any resources created by the provider, such as Pods referencing the `SecretProviderClass` and the `scaleway-credentials` Secret: + + ```bash + kubectl delete pod test-secret-pod + kubectl delete secret scaleway-credentials + kubectl delete secretproviderclass scaleway-provider + ``` + +2. Once these resources have been deleted, uninstall the provider. To uninstall with Helm, execute: + + ```bash + helm delete scaleway-secrets-store-csi --namespace kube-system + ``` + +3. If you no longer need the Secrets Store CSI Driver itself, you can also remove it: + + ```bash + helm delete csi-secrets-store --namespace kube-system + ``` + +## Troubleshooting + +### Check logs + +The provider runs as a DaemonSet, so there is one provider pod on every node. To troubleshoot issues with a specific application pod, look at the logs of the provider pod running on the **same node** as your application pod: + +```bash +kubectl get pods -n kube-system -o wide +# Find the Scaleway CSI provider pod running on the same node as your application pod +kubectl logs -n kube-system scaleway-secrets-store-csi-xxxxx +``` + +### Enable debug mode + +To enable debug mode when installing with Helm, set the `provider.debug` value to `true`: + +```bash +helm upgrade --install scaleway-secrets-store-csi --namespace kube-system scaleway/scaleway-secrets-store-csi \ + --set provider.debug=true +``` + +Alternatively, if you use a values file, set `debug` to `true`: + +```yaml +provider: + debug: true +``` + + +Still need help? [Create a Support ticket](https://console.scaleway.com/support/tickets/create) + \ No newline at end of file diff --git a/pages/secret-manager/menu.ts b/pages/secret-manager/menu.ts index 2c4125a6ae..3951bac426 100644 --- a/pages/secret-manager/menu.ts +++ b/pages/secret-manager/menu.ts @@ -82,6 +82,10 @@ export const secretManagerMenu = { label: 'Secret Manager API Reference', slug: 'https://www.scaleway.com/en/developers/api/secret-manager/', }, + { + label: 'Deploying the Scaleway Secret Manager CSI provider on Kubernetes', + slug: 'deploying-secret-manager-csi-provider-kubernetes', + }, { label: 'Deploying External Secrets on Kubernetes Kapsule', slug: 'external-secrets', From 56c995693b33245dce38a8be5d7a09bedefa4247 Mon Sep 17 00:00:00 2001 From: Vanda ILLYES Date: Fri, 4 Sep 2026 15:47:05 +0200 Subject: [PATCH 02/11] feat(secret-manager): editorial improvements --- ...secret-manager-csi-provider-kubernetes.mdx | 112 +++++++++--------- 1 file changed, 56 insertions(+), 56 deletions(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 853804ed9b..476a6d3dff 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -3,8 +3,8 @@ title: Deploying the Scaleway Secret Manager CSI provider on Kubernetes description: Learn how to install the Scaleway Secret Manager provider for Secrets Store CSI Driver on Kubernetes and mount secrets as volumes in your pods. tags: secret-manager kubernetes csi secrets helm dates: - validation: 2026-09-03 - posted: 2026-09-04 + validation: 2026-09-04 + posted: 2026-09-07 categories: - secret-manager --- @@ -14,11 +14,11 @@ import Requirements from '@macros/iam/requirements.mdx' The [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) is a [Kubernetes CSI](https://kubernetes-csi.github.io/docs/) driver that enables you to mount secrets from external secret stores as volumes in your Kubernetes pods. -The **Scaleway Secret Manager provider for Secrets Store CSI Driver** (also called "the provider" in the remainder of this document) connects these two together: it allows you to get secrets stored in Scaleway Secret Manager and use the Secrets Store CSI Driver interface to mount them directly into your Kubernetes pods as files. +The **Scaleway Secret Manager provider for Secrets Store CSI Driver** (also called "the Secret Manager provider" or "the provider" in the remainder of this document) connects these two together: it allows you to get secrets stored in Scaleway Secret Manager and use the Secrets Store CSI Driver interface to mount them directly into your Kubernetes pods as files. -Unlike [External Secrets](https://external-secrets.io), which materializes external secrets as Kubernetes `Secret` objects managed by an operator, the Scaleway Secret Manager provider mounts the secret contents directly into pods through the CSI volume interface, without creating intermediary Kubernetes secrets. +Unlike [External Secrets](https://external-secrets.io), which materializes external secrets as Kubernetes `Secret` objects managed by an operator, the Secret Manager provider mounts the secret contents into pods without creating intermediary Kubernetes secrets. -In this tutorial, you will learn how to install this provider on your Kubernetes cluster, define which secrets to mount, and access them from your application pods. +In this tutorial, you will learn how to install the Secret Manager provider on your Kubernetes cluster, define which secrets to mount, and access them from your application pods. @@ -26,9 +26,9 @@ In this tutorial, you will learn how to install this provider on your Kubernetes - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization - A Kubernetes cluster, for example a [Kubernetes Kapsule](/kubernetes/concepts/#kubernetes-kapsule) cluster, with `kubectl` configured to access it - Installed [helm](https://helm.sh/), the Kubernetes package manager, on your local machine (version 3 or later) -- At least one secret already [created in Scaleway Secret Manager](/secret-manager/quickstart/) +- Created at least one secret in [Scaleway Secret Manager](/secret-manager/quickstart/) -If you plan to use a dedicated application or service account with a custom IAM policy, the minimum set of permissions required is: +If you plan to use a dedicated application or service account with a custom [IAM policy](/iam/how-to/create-policy/), the minimum set of permissions required is: - `SecretManagerReadOnly` - `SecretManagerSecretAccess` @@ -44,7 +44,7 @@ helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver See the official [Secrets Store CSI Driver installation documentation](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation.html) for alternative installation methods and options. -## Install the Scaleway Secret Manager provider +## Install the Secret Manager provider ### Install using Helm @@ -66,11 +66,11 @@ You can also install the provider using the deployment configuration provided in kubectl apply -n kube-system -f https://raw.githubusercontent.com/scaleway/scaleway-secrets-store-csi/main/deployment/secrets-store-csi-driver-provider-scw.yaml ``` -This installs the provider as a `DaemonSet` (so it runs on every node) together with its `ServiceAccount`, `ClusterRole`, and `ClusterRoleBinding`. +This command installs the provider as a `DaemonSet` (so it runs on every node) together with its `ServiceAccount`, `ClusterRole`, and `ClusterRoleBinding`. ## Create the Scaleway credentials Secret -To authenticate to Scaleway, create a Kubernetes Secret containing your Scaleway API credentials (that is, the access key and secret key of your API key). Remember to replace placeholders `` and `` with your actual values. +To authenticate to Scaleway, create a Kubernetes Secret containing your Scaleway API credentials (that is, the access key and secret key of your API key). Remember to replace placeholders `my-access-key` and `my-secret-key` with your actual values. See the [IAM documentation](/iam/how-to/create-api-keys/) for details on how to create an API key. @@ -82,8 +82,8 @@ metadata: namespace: default type: Opaque stringData: - accessKey: "" - secretKey: "" + accessKey: "my-access-key" + secretKey: "my-secret-key" ``` @@ -105,16 +105,16 @@ spec: parameters: apiURL: "https://api.scaleway.com" insecure: "false" - defaultOrganizationID: "<573e26e8-45b7-4859-aa81-547de6e9acff>" - defaultProjectID: "<6a4027ce-58c3-4adb-9b69-7ff6e1f317d2>" + defaultOrganizationID: "573e26e8-45b7-4859-aa81-547de6e9acff" + defaultProjectID: "6a4027ce-58c3-4adb-9b69-7ff6e1f317d2" defaultRegion: "fr-par" objects: | - - secretID: "" + - secretID: "e6a5d04a-c2c2-49a3-8180-09452bf64e26" revision: "latest_enabled" - targetPath: "" - - projectID: "" - secretPath: "" - secretName: "" + targetPath: "my-secret" + - projectID: "dfdc0cab-c99b-479d-a8f0-1df78cd9f67e" + secretPath: "/test" + secretName: "my-other-secret" revision: "latest_enabled" ``` @@ -126,55 +126,59 @@ The `parameters` section supports the following settings: | `insecure` | Set to `"true"` to disable TLS verification (for testing against a local API) | `"false"` | | `defaultOrganizationID` | Default Organization ID used when no Project is specified | none | | `defaultProjectID` | Default Project ID containing the secrets | none | -| `defaultRegion` | The [region](/secret-manager/concepts/#region) of your secrets | none (required) | -| `objects` | Contains the definition of each secret to mount (YAML), either by **Secret ID** or by **Secret Path** (see section [Access secrets](#access-secrets)). | none (required) | +| `defaultRegion` | [required] The [region](/secret-manager/concepts/#region) of your secrets | none | +| `objects` | [required] A YAML-formatted list that defines each secret to mount, specified either by its [secret ID](#access-a-secret-by-secret-id) or its [secret path](#access-a-secret-by-secret-path) | none | -## Access secrets +### Access secrets -### Access a secret by secret ID +#### Access a secret by secret ID To access a secret version by its ID, specify the `secretID` field. Remember to replace the placeholders with your actual values. ```yaml objects: | - - secretID: "" + - secretID: "e6a5d04a-c2c2-49a3-8180-09452bf64e26" revision: "latest_enabled" - targetPath: "" + targetPath: "my-secret" ``` Where: -- `secretID`: The UUID of the secret -- `revision`: The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. (optional, defaults to `latest_enabled`) -- `targetPath`: The relative path where the secret will be mounted +| Parameter | Description | Default | +|--------------|------------------------|---------| +| `secretID` | The UUID of the secret | none | +| `revision` | [optional] The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | `latest_enabled` | +| `targetPath` | The relative path where the secret will be mounted | none | -### Access a secret by secret path +#### Access a secret by secret path + + +A secret must be specified either by ID or by path, but not both. If you specify an ID, the path fields are ignored. + To access a secret version by its path, specify the `secretPath` and `secretName` fields. Remember to replace the placeholders with your actual values. ```yaml objects: | - - projectID: "" - secretPath: "" - secretName: "" + - projectID: "dfdc0cab-c99b-479d-a8f0-1df78cd9f67e" + secretPath: "/test" + secretName: "my-other-secret" revision: "latest_enabled" ``` -**Where:** +Where: -- `projectID`: The project ID containing the secret (optional, defaults to `defaultProjectID` or `defaultOrganizationID`) -- `secretPath`: The absolute path to the secret folder -- `secretName`: The name of the secret -- `revision`: The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. (optional, defaults to `latest_enabled`) -- `targetPath`: The relative path where the secret will be mounted (optional, defaults to `secretPath/secretName`) +| Parameter | Description | Default | +|--------------|------------------------|---------| +| `projectID` | [optional] The project ID containing the secret | `defaultProjectID` or `defaultOrganizationID` | +| `secretPath` | The absolute path to the secret folder | none | +| `secretName` | The name of the secret | none | +| `revision` | [optional] The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | `latest_enabled` | +| `targetPath` | [optional] The relative path where the secret will be mounted | `secretPath/secretName` | - -A secret must be specified either by ID or by path, but not both. If you specify an ID, the path fields are ignored. - - -## Mount secrets in a Pod +## Mount secrets in a pod -Now that the `SecretProviderClass` is defined, mount the secrets in your application Pod by referencing it through a CSI volume. Create a Pod similar to the following: +Now that the `SecretProviderClass` is defined, mount the secrets in your application pod by referencing it through a CSI volume. Create a pod similar to the following: ```yaml apiVersion: v1 @@ -207,7 +211,7 @@ The `csi` volume: - points to the `SecretProviderClass` via the `secretProviderClass` volume attribute - references the credentials Secret created earlier through `nodePublishSecretRef` -Once the Pod is running, the secrets are mounted as files under the `mountPath`. You can verify that the secrets are accessible inside the Pod: +Once the pod is running, the secrets are mounted as files under the `mountPath`. You can verify that the secrets are accessible inside the pod by executing the following: ```bash kubectl exec test-secret-pod -- ls -l /mnt/secrets @@ -215,12 +219,12 @@ kubectl exec test-secret-pod -- cat /mnt/secrets/my-secret ``` -Mounted secrets are written to the node's filesystem when the Pod is scheduled. Changes made to the secret in Secret Manager (for example, a new revision) are not reflected automatically in a running Pod; recreate or restart the Pod to pick up the latest revision. +Mounted secrets are written to the filesystem of the node when the pod is scheduled. Changes made to the secret in Secret Manager (for example, a new revision) are not reflected automatically in a running pod. Recreate or restart the pod to pick up the latest revision. ## Uninstall the provider -1. Delete any resources created by the provider, such as Pods referencing the `SecretProviderClass` and the `scaleway-credentials` Secret: +1. Delete any resources created by the provider, such as pods referencing the `SecretProviderClass` and the `scaleway-credentials` Secret: ```bash kubectl delete pod test-secret-pod @@ -228,7 +232,7 @@ Mounted secrets are written to the node's filesystem when the Pod is scheduled. kubectl delete secretproviderclass scaleway-provider ``` -2. Once these resources have been deleted, uninstall the provider. To uninstall with Helm, execute: +2. Once the resources have been deleted, uninstall the provider. To uninstall with Helm, execute the following command: ```bash helm delete scaleway-secrets-store-csi --namespace kube-system @@ -240,11 +244,11 @@ Mounted secrets are written to the node's filesystem when the Pod is scheduled. helm delete csi-secrets-store --namespace kube-system ``` -## Troubleshooting +## Troubleshoot issues ### Check logs -The provider runs as a DaemonSet, so there is one provider pod on every node. To troubleshoot issues with a specific application pod, look at the logs of the provider pod running on the **same node** as your application pod: +The provider runs as a DaemonSet, so there is one provider pod on every node. To troubleshoot issues with a specific application pod, look at the logs of the provider pod running on the same node as your application pod: ```bash kubectl get pods -n kube-system -o wide @@ -261,13 +265,9 @@ helm upgrade --install scaleway-secrets-store-csi --namespace kube-system scalew --set provider.debug=true ``` -Alternatively, if you use a values file, set `debug` to `true`: +Alternatively, if you use a `values.yaml` file, set `debug` to `true`: ```yaml provider: debug: true -``` - - -Still need help? [Create a Support ticket](https://console.scaleway.com/support/tickets/create) - \ No newline at end of file +``` \ No newline at end of file From 29ea7abbe90975f23f3e96362b56064012b53a7d Mon Sep 17 00:00:00 2001 From: Vanda ILLYES Date: Fri, 4 Sep 2026 17:48:14 +0200 Subject: [PATCH 03/11] feat(secret-manager): editorial improvements --- ...secret-manager-csi-provider-kubernetes.mdx | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 476a6d3dff..f477d550b4 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -120,14 +120,14 @@ spec: The `parameters` section supports the following settings: -| Parameter | Description | Default | -|-----------|-------------|---------| -| `apiURL` | The Scaleway API URL | `https://api.scaleway.com` | -| `insecure` | Set to `"true"` to disable TLS verification (for testing against a local API) | `"false"` | -| `defaultOrganizationID` | Default Organization ID used when no Project is specified | none | -| `defaultProjectID` | Default Project ID containing the secrets | none | -| `defaultRegion` | [required] The [region](/secret-manager/concepts/#region) of your secrets | none | -| `objects` | [required] A YAML-formatted list that defines each secret to mount, specified either by its [secret ID](#access-a-secret-by-secret-id) or its [secret path](#access-a-secret-by-secret-path) | none | +| Parameter | Description | Required | Default | +|-----------|-------------|----------|---------| +| `apiURL` | The Scaleway API URL | | `https://api.scaleway.com` | +| `insecure` | Set to `"true"` to disable TLS verification (for testing against a local API) | | `"false"` | +| `defaultOrganizationID` | Default Organization ID used when no Project is specified | | none | +| `defaultProjectID` | Default Project ID containing the secrets | | none | +| `defaultRegion` | The [region](/secret-manager/concepts/#region) of your secrets | yes | none | +| `objects` | A YAML-formatted list that defines each secret to mount, specified either by its [secret ID](#access-a-secret-by-secret-id) or its [secret path](#access-a-secret-by-secret-path) | yes | none | ### Access secrets @@ -144,11 +144,11 @@ objects: | Where: -| Parameter | Description | Default | -|--------------|------------------------|---------| -| `secretID` | The UUID of the secret | none | -| `revision` | [optional] The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | `latest_enabled` | -| `targetPath` | The relative path where the secret will be mounted | none | +| Parameter | Description | Required | Default | +|--------------|------------------------|----------|---------| +| `secretID` | The UUID of the secret | yes | none | +| `revision` | The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | no |`latest_enabled` | +| `targetPath` | The relative path where the secret will be mounted | | none | #### Access a secret by secret path @@ -168,13 +168,13 @@ objects: | Where: -| Parameter | Description | Default | -|--------------|------------------------|---------| -| `projectID` | [optional] The project ID containing the secret | `defaultProjectID` or `defaultOrganizationID` | -| `secretPath` | The absolute path to the secret folder | none | -| `secretName` | The name of the secret | none | -| `revision` | [optional] The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | `latest_enabled` | -| `targetPath` | [optional] The relative path where the secret will be mounted | `secretPath/secretName` | +| Parameter | Description | Required | Default | +|--------------|------------------------|----------|---------| +| `projectID` | The project ID containing the secret | no | `defaultProjectID` or `defaultOrganizationID` | +| `secretPath` | The absolute path to the secret folder | yes | none | +| `secretName` | The name of the secret | | none | +| `revision` | The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | no |`latest_enabled` | +| `targetPath` | The relative path where the secret will be mounted | no | `secretPath/secretName` | ## Mount secrets in a pod From 3aea2f8e21ea863115b526f30d9cb78f993de493 Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Mon, 7 Sep 2026 17:25:15 +0200 Subject: [PATCH 04/11] Apply suggestion from @ojroques Co-authored-by: Olivier Roques --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index f477d550b4..694f6d5a7d 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -172,7 +172,7 @@ Where: |--------------|------------------------|----------|---------| | `projectID` | The project ID containing the secret | no | `defaultProjectID` or `defaultOrganizationID` | | `secretPath` | The absolute path to the secret folder | yes | none | -| `secretName` | The name of the secret | | none | +| `secretName` | The name of the secret | yes | none | | `revision` | The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | no |`latest_enabled` | | `targetPath` | The relative path where the secret will be mounted | no | `secretPath/secretName` | From 3e05959b819083bbe8cb38877b21886a00f58d38 Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Mon, 7 Sep 2026 17:25:32 +0200 Subject: [PATCH 05/11] Apply suggestion from @ojroques Co-authored-by: Olivier Roques --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 694f6d5a7d..90430822d6 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -122,10 +122,10 @@ The `parameters` section supports the following settings: | Parameter | Description | Required | Default | |-----------|-------------|----------|---------| -| `apiURL` | The Scaleway API URL | | `https://api.scaleway.com` | -| `insecure` | Set to `"true"` to disable TLS verification (for testing against a local API) | | `"false"` | -| `defaultOrganizationID` | Default Organization ID used when no Project is specified | | none | -| `defaultProjectID` | Default Project ID containing the secrets | | none | +| `apiURL` | The Scaleway API URL | no | `https://api.scaleway.com` | +| `insecure` | Set to `"true"` to disable TLS verification (for testing against a local API) | no | `"false"` | +| `defaultOrganizationID` | Default Organization ID used when no Project is specified | yes | none | +| `defaultProjectID` | Default Project ID containing the secrets | no | `defaultOrganizationID` | | `defaultRegion` | The [region](/secret-manager/concepts/#region) of your secrets | yes | none | | `objects` | A YAML-formatted list that defines each secret to mount, specified either by its [secret ID](#access-a-secret-by-secret-id) or its [secret path](#access-a-secret-by-secret-path) | yes | none | From 06c0edea2aed9a5372830829715767285a59f6ac Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Mon, 7 Sep 2026 17:25:40 +0200 Subject: [PATCH 06/11] Apply suggestion from @ojroques Co-authored-by: Olivier Roques --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 90430822d6..528b30d995 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -148,7 +148,7 @@ Where: |--------------|------------------------|----------|---------| | `secretID` | The UUID of the secret | yes | none | | `revision` | The revision to access, e.g., `latest_enabled`, `1`, `2`, etc. | no |`latest_enabled` | -| `targetPath` | The relative path where the secret will be mounted | | none | +| `targetPath` | The relative path where the secret will be mounted | yes | none | #### Access a secret by secret path From d1aae90de49d7a103530c4b8593a2d7b54930a0b Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Tue, 8 Sep 2026 16:35:04 +0200 Subject: [PATCH 07/11] Apply suggestion from @Loic-kd Co-authored-by: Loic-kd --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 528b30d995..e6ebc502bc 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -14,7 +14,7 @@ import Requirements from '@macros/iam/requirements.mdx' The [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) is a [Kubernetes CSI](https://kubernetes-csi.github.io/docs/) driver that enables you to mount secrets from external secret stores as volumes in your Kubernetes pods. -The **Scaleway Secret Manager provider for Secrets Store CSI Driver** (also called "the Secret Manager provider" or "the provider" in the remainder of this document) connects these two together: it allows you to get secrets stored in Scaleway Secret Manager and use the Secrets Store CSI Driver interface to mount them directly into your Kubernetes pods as files. +The **Scaleway Secret Manager provider for Secrets Store CSI Driver** (also called "the Secret Manager provider" or "the provider" on this page) connects these two together: it allows you to get secrets stored in Scaleway Secret Manager and use the Secrets Store CSI Driver interface to mount them directly into your Kubernetes pods as files. Unlike [External Secrets](https://external-secrets.io), which materializes external secrets as Kubernetes `Secret` objects managed by an operator, the Secret Manager provider mounts the secret contents into pods without creating intermediary Kubernetes secrets. From 49c19e0f5efbd4b85b4804c3a7df6d6a3ff03c82 Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Tue, 8 Sep 2026 16:36:07 +0200 Subject: [PATCH 08/11] Apply suggestion from @mmfrayssens Co-authored-by: mmfrayssens --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index e6ebc502bc..0055a9988d 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -72,7 +72,7 @@ This command installs the provider as a `DaemonSet` (so it runs on every node) t To authenticate to Scaleway, create a Kubernetes Secret containing your Scaleway API credentials (that is, the access key and secret key of your API key). Remember to replace placeholders `my-access-key` and `my-secret-key` with your actual values. -See the [IAM documentation](/iam/how-to/create-api-keys/) for details on how to create an API key. +See [How to create API keys](/iam/how-to/create-api-keys/) in the IAM documentation for details. ```yaml apiVersion: v1 From fed0a45735247925d58b7d6b40e9a69fd760eee1 Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Tue, 8 Sep 2026 16:45:48 +0200 Subject: [PATCH 09/11] Apply suggestion from @Loic-kd Co-authored-by: Loic-kd --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 0055a9988d..0810e09c5b 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -232,7 +232,7 @@ Mounted secrets are written to the filesystem of the node when the pod is schedu kubectl delete secretproviderclass scaleway-provider ``` -2. Once the resources have been deleted, uninstall the provider. To uninstall with Helm, execute the following command: +2. After the resources have been deleted, uninstall the provider. To uninstall with Helm, execute the following command: ```bash helm delete scaleway-secrets-store-csi --namespace kube-system From 05b51dba62106e69bbb1129a030888a6e9eb5d2f Mon Sep 17 00:00:00 2001 From: Vanda ILLYES Date: Tue, 8 Sep 2026 16:53:17 +0200 Subject: [PATCH 10/11] feat(secret-manager): apply peer review comments --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 0810e09c5b..370d2dd570 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -16,7 +16,7 @@ The [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) is The **Scaleway Secret Manager provider for Secrets Store CSI Driver** (also called "the Secret Manager provider" or "the provider" on this page) connects these two together: it allows you to get secrets stored in Scaleway Secret Manager and use the Secrets Store CSI Driver interface to mount them directly into your Kubernetes pods as files. -Unlike [External Secrets](https://external-secrets.io), which materializes external secrets as Kubernetes `Secret` objects managed by an operator, the Secret Manager provider mounts the secret contents into pods without creating intermediary Kubernetes secrets. +Unlike [External Secrets](https://external-secrets.io), which generates external secrets as Kubernetes `Secret` objects managed by an operator, the Secret Manager provider mounts the secret contents into pods without creating intermediary Kubernetes secrets. In this tutorial, you will learn how to install the Secret Manager provider on your Kubernetes cluster, define which secrets to mount, and access them from your application pods. @@ -118,7 +118,7 @@ spec: revision: "latest_enabled" ``` -The `parameters` section supports the following settings: +The `parameters` section supports the following settings. | Parameter | Description | Required | Default | |-----------|-------------|----------|---------| @@ -238,7 +238,7 @@ Mounted secrets are written to the filesystem of the node when the pod is schedu helm delete scaleway-secrets-store-csi --namespace kube-system ``` -3. If you no longer need the Secrets Store CSI Driver itself, you can also remove it: +3. You can also remove the Secrets Store CSI Driver itself if you no longer need it: ```bash helm delete csi-secrets-store --namespace kube-system From fc00ecb56a09dcaf6df4e21ff48a102441f7283a Mon Sep 17 00:00:00 2001 From: vanda-scw Date: Wed, 9 Sep 2026 09:46:19 +0200 Subject: [PATCH 11/11] Update pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx Co-authored-by: mmfrayssens --- .../deploying-secret-manager-csi-provider-kubernetes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx index 370d2dd570..5476aa1372 100644 --- a/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx +++ b/pages/secret-manager/api-cli/deploying-secret-manager-csi-provider-kubernetes.mdx @@ -90,7 +90,7 @@ stringData: The provider does not support authentication with a Kubernetes Service Account yet. -## Create a SecretProviderClass +## Create a `SecretProviderClass` A `SecretProviderClass` defines which secrets from Scaleway Secret Manager should be mounted. Create a `SecretProviderClass` in the namespace where your application runs, referencing the credentials Secret created in the previous step. Remember to replace the placeholders with your actual values.