Retrieve secret based on labels

[ap0phi5]

TL;DR

If the consumer does not know the secret Name, the consumer should be able to select a secret based on key-value attributes. Users otherwise have to resort to establishing some sort of naming convention, which can be somewhat fragile.

Example:

Design

Proposal
Since the resourceName is not known, we need to instead include a format for querying labels.

resourceName: "projects/$PROJECT_ID/secrets/??????/versions/latest"

Solution

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: app-secrets
spec:
  provider: gcp
  parameters:
    secrets: |
      - projectId: "$PROJECT_ID"
        versions: "latest"
        labels: |
          - environment: "dev01"
            name: "test"