secrets-store-csi-driver-operator

An operator to deploy the Secrets Store CSI Driver.

Quick start

To build and run the operator locally:

# Create only the resources the operator needs to run via CLI
oc apply -f - <<EOF
apiVersion: operator.openshift.io/v1
kind: ClusterCSIDriver
metadata:
    name: secrets-store.csi.k8s.io
spec:
  logLevel: Normal
  managementState: Managed
  operatorLogLevel: Trace
EOF

# Apply SecretProviderClass CRDs before starting the operator:
```sh
oc apply -f config/manifests/stable/secrets-store.csi.x-k8s.io_secretproviderclasses.yaml \
         -f config/manifests/stable/secrets-store.csi.x-k8s.io_secretproviderclasspodstatuses.yaml

Build the operator

make

Set the environment variables

export OPERATOR_NAME=secrets-store-csi-driver-operator export DRIVER_IMAGE=registry.k8s.io/csi-secrets-store/driver:v1.6.0 export NODE_DRIVER_REGISTRAR_IMAGE=quay.io/openshift/origin-csi-node-driver-registrar:latest export LIVENESS_PROBE_IMAGE=quay.io/openshift/origin-csi-livenessprobe:latest

Run the operator via CLI

./secrets-store-csi-driver-operator start --kubeconfig $KUBECONFIG --namespace openshift-cluster-csi-drivers

## Bumping OCP version in CSV and OLM metadata

This updates the package versions in `config/manifests/secrets-store-csi-driver-operator.package.yaml`, `config/manifests/stable/secrets-store-csi-driver-operator.clusterserviceversion.yaml`, `README.md` and `Makefile` to 4.20:

./hack/update-metadata.sh 4.20

# OLM

To build bundle and index images, use the `hack/create-bundle` script:

```shell
cd hack
./create-bundle registry.ci.openshift.org/ocp/5.0:secrets-store-csi-driver registry.ci.openshift.org/ocp/5.0:secrets-store-csi-driver-operator quay.io/<my_user>/secrets-store-bundle quay.io/<my_user>/secrets-store-index

At the end it will print a command that creates Subscription for the newly created index image.

Using the must-gather image

The must-gather image for secrets-store-csi-driver-operator supplements the openshift/must-gather image to gather Secrets Store related resources.

oc adm must-gather --image=quay.io/openshift/origin-secrets-store-csi-mustgather:latest

This command creates a must-gather containing:

• Logs and resources in the operator namespace (openshift-cluster-csi-drivers)
• SecretProviderClass and SecretProviderClassPodStatus objects
• ClusterCSIDriver and CSIDriver objects

To build the must-gather image locally:

REPO=quay.io/<user>/secrets-store-csi-mustgather:latest
docker build -t ${REPO} -f Dockerfile.mustgather .

E2E Coverage

The operator supports collecting E2E test coverage data and uploading it to Codecov.

How it works

A separate Dockerfile.coverage builds the operator binary with Go's -cover flags. The coverage-instrumented binary behaves identically to production but tracks which lines are executed. After E2E tests, SIGTERM flushes coverage data to /tmp/e2e-cover, and the data is copied out for conversion and upload.

In CI, the hack/e2e-coverage.sh script handles the full lifecycle:

• setup -- patches the live CSV to swap in the coverage image and set GOCOVERDIR
• collect -- sends SIGTERM, waits for container restart, copies coverage data, converts to a Go profile, and uploads to Codecov

Local usage

# Build and push the coverage image
make docker-build-coverage COVERAGE_IMG=quay.io/<user>/secrets-store-csi-driver-operator:e2e-coverage
make docker-push-coverage COVERAGE_IMG=quay.io/<user>/secrets-store-csi-driver-operator:e2e-coverage

# After operator is deployed via OLM
COVERAGE_IMAGE=quay.io/<user>/secrets-store-csi-driver-operator:e2e-coverage hack/e2e-coverage.sh setup

# Run E2E tests
make test-e2e

# Collect coverage (optionally set CODECOV_TOKEN to upload)
hack/e2e-coverage.sh collect

# View HTML report
go tool cover -html=coverage-e2e.out

Updating vendored CRDs

This copies the secretproviderclasses and secretproviderclasspodstatuses CRDs from a secrets-store-csi-driver release tag into config/manifests/stable/:

./hack/update-crds.sh v1.6.0