<p>We configured CSI driver in our cluster for secret management and used the below secret provider class template to automatically assign secrets to the deployments env variable. The above setup is working fine.</p>
<p>But 2 things where I have issues. Whenever new changes were done to the secret, say if adding a new secret to the YAML and key vault, the next release will fail with the helm upgrade command, stating specified secret is not found.</p>
<p>So in order to solve this, I have to uninstall all helm releases and need to install the helm release again, which means down time, how can I achieve this scenario without any down time?</p>
<p>Secondly, is there any recommended way to restart the Pods when the secret template changes:</p>
<p>values.yaml for MyAppA</p>
<pre><code>keyvault:
  name: mykv
  tenantId: ${tenantId}$
  clientid: &quot;#{spid}#&quot;
  clientsecret: &quot;#{spsecret}#&quot;
  secrets:
    - MyAPPA_SECRET1_NAME1
    - MyAPPA_SECRET2_NAME2
    - MyAPPA_SECRET3_NAME3
</code></pre>
<p>deployment.yaml, ENV part is as below</p>
<pre><code>    {{- if eq .Values.keyvault.enabled true }}
    {{- range .Values.keyvault.secrets }}{{/* &lt;-- only one range loop */}}
      - name: {{ . }}
        valueFrom:
          secretKeyRef:
            name: {{ $.Release.Name }}-kvsecret
            key: {{ . }}
      {{- end }}
      {{- end }}
      volumeMounts: 
      - name:  {{ $.Release.Name }}-volume
        mountPath: '/mnt/secrets-store'
        readOnly: true
  volumes:
    - name: {{ $.Release.Name }}-volume
      csi:
        driver: 'secrets-store.csi.k8s.io'
        readOnly: true
        volumeAttributes:
          secretProviderClass: {{ $.Release.Name }}-secretproviderclass
        nodePublishSecretRef:
          name: {{ $.Release.Name }}-secrets-store-creds
          
          
</code></pre>
<p>secretProviderClass yaml file is as below.</p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: {{ $.Release.Name }}-secretproviderclass
  labels:
    app: {{ $.Release.Name }}
    chart: &quot;{{ $.Release.Name }}-{{ .Chart.Version }}&quot;
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  provider: azure
  secretObjects:
  - data:
      {{- range .Values.keyvault.secrets }}{{/* &lt;-- only one range loop */}}
    - key: {{ . }}
      objectName: {{ $.Release.Name | upper }}-{{ . }} 
      {{- end }}      
    secretName: {{ $.Release.Name }}-kvsecret
    type: opaque
  parameters:
    usePodIdentity: &quot;false&quot;
    useVMManagedIdentity: &quot;false&quot;
    userAssignedIdentityID: &quot;&quot;
    keyvaultName: {{ .Values.keyvault.name | default &quot;mydev-kv&quot; }}   
    objects: |
      array:
        {{- range .Values.keyvault.secrets }}{{/* &lt;-- only one range loop */}}        
        - |
          objectName: {{ $.Release.Name | upper }}-{{ . }}
          objectType: secret
        {{- end }}
    tenantId: {{ .Values.keyvault.tenantid }}
{{- end }}
{{- end -}}
{{- define &quot;commonobject.secretproviderclass&quot; -}}
{{- template &quot;commonobject.util.merge&quot; (append . &quot;commonobject.secretproviderclass.tpl&quot;) -}}
{{- end -}}
</code></pre>

Vowneee
<p>The problem is not in the &quot;helm upgrade&quot; command. I discovered this is a limitation of a CSI driver or SecretProviderClass. When the deployment is already created, the SecretProviderClass resource is updated but the &quot;SecretProviderClassPodStatuses&quot; is not, so secrets are not updated.</p>
<p>Two potential solutions to update secrets:</p>
<ul>
<li>delete secret and restart/recreate pod =&gt; this works but it sounds more like a workaround than an actual solution</li>
<li>set enableSecretRotation to true =&gt; it has been implemented in a CSI driver recently and it's in an 'alpha' version</li>
</ul>
<p><a href="https://secrets-store-csi-driver.sigs.k8s.io/topics/secret-auto-rotation.html" rel="nofollow noreferrer">https://secrets-store-csi-driver.sigs.k8s.io/topics/secret-auto-rotation.html</a></p>
<p><strong>Edited:</strong></p>
<p>In the end, I used this command to use <strong>automatic secret rotation</strong> in Azure Kubernetes Service:</p>
<pre><code>az aks addon update -g [resource-group] -n [aks-name] -a azure-keyvault-secrets-provider --enable-secret-rotation --rotation-poll-interval 0.5m
</code></pre>
<p>You can use the following command to check if this option is enabled:</p>
<pre><code>az aks addon show -g [resource-group] -n [aks-name] -a azure-keyvault-secrets-provider
</code></pre>
<p>More info here:
<a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#enable-and-disable-autorotation" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#enable-and-disable-autorotation</a></p>
