openshell-driver-kubernetes-secrets

openshell-driver-kubernetes-secrets --bind-socket PATH [options]

openshell-driver-kubernetes-secrets is the Kubernetes Secrets credential driver for NVIDIA OpenShell. It serves the CredentialDriver gRPC API on a Unix socket. openshell-gateway uses that API to store and resolve provider credentials as Secret objects. The process removes the socket when it exits.--bind-socket is required. The parent directory is created if needed. An existing socket is removed and replaced. Any other file at that path is an error. The new socket is mode 0600. The listener does not check the peer pid; access is the file mode.The Kubernetes client is the default client: in-cluster configuration when it is present, otherwise the local kubeconfig. A client that cannot be built fails at startup.--namespace selects the only namespace this process will read or write. When the flag is omitted, the driver reads the namespace from the in-cluster service-account file and, if that file is missing or not a namespace name, uses default. A handle that names a different namespace is rejected. Secrets this driver creates are labeled as managed by OpenShell. It will not overwrite a Secret it did not create for that provider credential. Listing credentials is not implemented.The gateway table that carries the same field is [openshell.credential_drivers.kubernetes-secrets]. Unknown keys are rejected. This binary does not read that file itself; the flags are the standalone configuration.

--bind-socket PATH

Required. Unix socket for the CredentialDriver service.

Namespace for Secret objects. Must be a DNS label. Default is the in-cluster namespace file, then default.

Log level. Default info. Used when the process environment does not already set a tracing filter.

A gateway table with the same field:

$ [openshell.credential_drivers.kubernetes-secrets]
namespace = "openshell"

$ --bind-socket   OPENSHELL_CREDENTIAL_DRIVER_SOCKET
--namespace     OPENSHELL_KUBERNETES_SECRETS_NAMESPACE
--log-level     OPENSHELL_LOG_LEVEL

This is not the compute driver. Sandbox pods are created by openshell-driver-kubernetes. This process only stores provider credential bytes in Secret objects.The socket is unlinked after the server stops. A crash can leave a stale socket; the next start removes it only when it is still a socket.Concurrent updates of the same Secret are retried a few times and then fail. A Secret that is not labeled as managed by OpenShell for this credential is left in place.

openshell-driver-kubernetes-secrets ships in NVIDIA OpenShell (Apache License 2.0). OpenShell was first published in March 2026. The 0.1.x line is the stable release cadence.

openshell(1), openshell-gateway(1), openshell-driver-kubernetes(1), openshell-driver-vault(1), kubectl(1)

Source code · Homepage