Avoid requesting the same secret more than once

[alonstern]

Hi,

I have a k8s cluster with a few thousands pods, which all use the same secrets. The CSI driver make a number of secrets * number of pods requests to the keyvault. This causes some issues where the Keyvault is throttling, and the CSI driver does not handle it well and my pods gets into a restart-loop.

Is there a way to configure the CSI driver such that each secret will be requested once and not per pod?

[mr-onion-2]

I've not noticed throttling or any restart loops but on a similar note we did have a significant cost increase after enabling auto-rotation. The volume of requests increased the daily keyvault costs from a few pence to approx £2, per day, per keyvault.

Reducing the polling frequency isn't really desirable. We are planning to switch from mounting the SCP in every pod that needs it to a few dedicated pods only. The resulting secret will then of course be shared by all the other pods.