--- title: "Fortanix DSM with Secret Store CSI Driver" slug: "fortanix-dsm-using-secret-store-csi-driver" updated: 2026-07-08T18:10:53Z published: 2026-07-08T18:10:53Z canonical: "support.fortanix.com/fortanix-dsm-using-secret-store-csi-driver" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM with Secret Store CSI Driver ## 1.0 Introduction This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Secrets Store Container Storage Interface (CSI) Driver** solution to securely access secrets such as API keys, passwords, and certificates in Kubernetes pods. The **Fortanix CSI Provider** allows you to use secrets stored in Fortanix DSM and mount them into Kubernetes pods using the CSI Driver to securely access and manage the data stored in Fortanix DSM by the applications running in Kubernetes. ## 2.0 Tested Product Versions The following product versions were tested: - Fortanix DSM version 4.33.2488, 5.6.2930 - Kubernetes version 1.16, 1.32.2 - Secret Store CSI Driver version 1.4.6, 1.5.6 - Fortanix CSI Provider version 0.0.21 - Helm version 3.20.1 - Docker version 28.1.1 - Go version 1.22.5 ## 3.0 Prerequisites Ensure the following: - A Kubernetes cluster version 1.16 or above is installed and running. - The Fortanix DSM is accessible. *For more information, refer to* [*Section 5.1: Signing Up*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#51-signing-up) *and* [*5.2: Creating an Account*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#52-creating-an-account)*.* - Download the Fortanix CSI Provider from the [*GitHub*](https://github.com/fortanix/fortanix-csi-provider) repository. ## 4.0 Architecture Diagram ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/CSI-Architecture-Diagram.png) **Figure 1: Architecture diagram** The Secret Store CSI Driver facilitates secure access and management of secrets within Kubernetes by integrating with an external secret management system, specifically Fortanix DSM. When a container requires a secret, it initiates a request to the Secret Store CSI Driver. The Secret Store CSI Driver works by interfacing with the secret management system, fetching the required secrets, and making them available at runtime without storing them on the cluster. To configure which secrets to fetch and how to mount them into the pod's file system, it utilizes a `SecretProviderClass` resource. After receiving the request, the CSI Driver interacts with a custom provider designed for Fortanix DSM. This provider is responsible for authenticating using predefined credentials and retrieving the requested secrets from Fortanix DSM. After the secrets are obtained, the CSI Driver makes them accessible to applications by either mounting them to a designated storage volume or exposing them as environment variables. This integration streamlines the process of secret retrieval for applications running in Kubernetes. ## 5.0 Configure Fortanix DSM A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections: ### 5.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 5.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png) **Figure 2: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ### 5.3 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(76).png) **Figure 3: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a name for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create a new group. *For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.* > [!NOTE] > TIP > > It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.* ### 5.4 Creating an Application Perform the following steps to create an application (app) in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(75).png) **Figure 4: Add application** 2. On the **Adding new app** page: 1. **App name**: Enter the name for your application. 2. **ADD DESCRIPTION** (optional): Enter a short description for the application. 3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.* 4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#53-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 5.5 Copying the API Key Perform the following steps to copy the API key from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#54-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app. 2. On the **INFO** tab, click **VIEW API KEY DETAILS**. 3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it while configuring the Fortanix CSI Provider. ### 5.6 Creating a Security Object > [!NOTE] > NOTE > > For this guide, two tokenization security objects are created. Perform the following steps to import a Secret key in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(32).png) **Figure 5: Adding security object** 2. On the **Add new Security Object** page: 1. **Security Object Name**: Enter the name for your security object. For example, **secret_name_1**. 2. **Group**: Select the group as created in [*Section 5.3: Creating a Group*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#53-creating-a-group). 3. Select **IMPORT**. 4. In the **Choose a type** section, select the **Secret** key type. 5. In the **Place value here or import from file** section, select the value format type as **Hex**, **Base64**, or **Raw**, and click **UPLOAD A FILE** to upload the key file. 6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying. > [!NOTE] > NOTE > > Ensure that the **Export** permission is selected. 3. Click **IMPORT** to create the new security object. 4. Similarly, repeat *Steps 1 to 3* to create another security object. For example, **secret_name_2**. *For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.* ## 6.0 Infrastructure Setup ### 6.1 Installing the Secret Store CSI Driver Perform the following steps to install the Secret Store CSI Driver using Helm: 1. Run the following command to add the CSI Driver: ```bash helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts ``` 2. Run the following command to install the CSI Driver: ```bash helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --namespace ``` Where, `<namespace>` is the name of the Kubernetes namespace. > [!NOTE] > NOTE > > Ensure you apply for it in the same namespace where the CSI Driver is installed. ### 6.2 Installing the Fortanix CSI Provider Perform the following steps to install the Fortanix CSI Provider: 1. Ensure that the `fortanix-csi-provider.yaml` file is cloned from the [*GitHub*](https://github.com/fortanix/fortanix-csi-provider/tree/main/deployment) repository. 2. Run the following command to apply the YAML file to your Kubernetes cluster: ```bash kubectl apply -f  fortanix-csi-provider.yaml -n ``` ### 6.3 Configuring the Fortanix CSI Provider Perform the following steps to configure the Fortanix CSI Provider : 1. Create a new `<secret_provider_class>.yaml` file and update it with the following: ```bash apiVersion: secrets-store.csi.x-k8s.io/v1 kind: SecretProviderClass metadata:  name: fortanix-test  namespace: spec:  provider: fortanix-csi-provider  parameters:    dsmEndpoint: ""    dsmApikey: ""    objects: |      - secretName: "" ``` > [!NOTE] > NOTE > > Ensure that the namespace in `<secret_provider_class>.yaml` matches the namespace in your `deployment.yaml` file. Refer to the sample `fortanix-secret-provider-class.yaml` file in the [*Examples*](https://github.com/fortanix/fortanix-csi-provider/tree/main/examples) section to update the Fortanix CSI Provider. To verify that the `SecretProviderClass` is configured correctly, refer to the following test pod YAML configuration (for example, `test-pod.yaml`) for validation: ```bash apiVersion: v1 kind: Pod metadata:  name: test-pod  namespace: csi-driver spec:  serviceAccountName: fortanix-csi-provider  containers:  - name: test-container    image: busybox    command: ["sleep", "3600"]    volumeMounts:    - name: secrets-store-inline      mountPath: "/mnt/secrets"      readOnly: true  volumes:  - name: secrets-store-inline    csi:      driver: secrets-store.csi.k8s.io      readOnly: true      volumeAttributes:        secretProviderClass: "fortanix-test" ``` - Update the `name` and `namespace`, if required. - Specify the `dsmEndpoint` in the configuration. - Add the `dsmAPIkey` generated in [*Section 5.5: Copying the API Key*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#55-copying-the-api-key). - Specify the `secretName` for both the security objects generated in [*Section 5.6: Creating a Security Object*](/v1/docs/fortanix-data-security-manager-using-secret-store-csi-driver#56-creating-a-security-object). 2. Save the updated file and run the following command to apply it to the cluster: ```bash kubectl apply -f .yaml -n ``` Where, - `<secret_provider_class>`: Refers to the secret provider class as created in *Step 1*. - `<namespace>`: Refers to the Kubernetes namespace. ## 7.0 Configure Secret Rotation and Synchronization ### 7.1 Enabling the Secret Rotation Perform the following steps to install the Secrets Store CSI Driver with secret rotation enabled: 1. Run the following command to install the Secrets Store CSI Driver with secret rotation enabled: ```bash helm install csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver \  --namespace \  --set enableSecretRotation=true \  --set rotationPollInterval= ``` Where, - `<namespace>`: Refers to the name of the Kubernetes namespace. - `enableSecretRotation=true`: Refers to enabling automatic secret rotation. - `rotationPollInterval=<duration>`: Refers to how often the CSI Driver checks for updated secrets. You can define the interval in minutes (for example, `2m`) or seconds (for example, `120s`). ### 7.2 Configuring Synchronization as Kubernetes Secret Perform the following steps to install the secrets store CSI Driver with secret synchronization enabled: 1. Run the following command to install the Secrets Store CSI Driver: ```bash helm install secrets-store-csi-driver secrets-store-csi-driver/secrets-store-csi-driver --namespace -- set syncSecret.enabled=true ``` Where, `<namespace>` is the name of the Kubernetes namespace. 2. Add the following content to the `<secret_provider_class>.yaml` file: ```bash secretObjects: - secretName: "" #The Kubernetes secret name type: Opaque #type of kubernetes secret (tls,sat,basic etc..,) labels: environment: "test" data: - objectName: #This should match the secret name given in Fortanix CSI Provider key: ``` Where, > [!NOTE] > NOTE > > - If the provider supports an alias for a mounted file, ensure that the `objectName` in `secretObjects` matches the mounted content. This can be either the original object name or the alias. > - Secrets are synced only when a pod mounts them. Enabling synchronization alone does not create or update Kubernetes Secrets. > - When all pods consuming a secret are deleted, the corresponding Kubernetes Secret is also deleted. > - You can also combine secret rotation and synchronization in a single Helm installation by using both flags together: > > ```bash > helm install secrets-store-csi-driver secrets-store-csi-driver/secrets-store-csi-driver \ >  --namespace \ >  --set enableSecretRotation=true \ >  --set syncSecret.enabled=true \ >  --set syncSecret.retryDuration=1m > ``` - `<secretName>`: Refers to the specific Kubernetes secret name. - `<objectName>`: Refers to the name of the object same as the secret name given in Fortanix CSI Provider. - `<key-value pair>`: Refers to the specific key-value pairs that match the Fortanix CSI Provider. ### 7.3 Secret Consumption Options - **File-based mount** – Secrets are mounted into the pod’s filesystem at a path (`/mnt/secrets`). - **Kubernetes Secret sync** – Secrets are synced into Kubernetes native Secret objects and can be consumed, such as any other Secret. - **Environment variable injection** – Secrets (synced as K8s Secrets) can be referenced in pod specifications. ## 8.0 Troubleshooting Perform the following steps to check logs from the CSI Provider pod: 1. Run the following command to get details about the DaemonSet pods and look for any errors: ```bash kubectl get pods -n -l app=fortanix-csi-provider ``` 2. Run the following command to get detailed information if the pod is not running: ```bash kubectl describe pod -n ``` Look for events and error messages in the output, such as **Failed**, **CrashLoopBackOff**, or **Error**. Where, `<fortanix-csi-provider-pod-name>` is the pod name of the Fortanix CSI Provider. 3. Run the following command to check the logs of the Fortanix CSI Provider pod to identify any issues that occurred during startup: ```bash kubectl logs -n ``` > [!NOTE] > NOTE > > If there are multiple containers in the pod, ensure to specify the container name with the `-c` flag: > > ```bash > kubectl logs -n -c provider-fortanix-installer > ``` 4. Run the following command if you suspect that the issue might be related to the node where the Fortanix CSI Provider is running. You can check the node logs for more context: ```bash kubectl logs -n -l app=fortanix-csi-provider ``` Where, - `<namespace>`: Refers to the name of the Kubernetes namespace. - `<node-name>`: Refers to the name of the Kubernetes node. Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.