OS Manuals

/usr/bin/secrets-store-csi

Secrets Store CSI driver for Kubernetes secrets

From secrets-store-csi-driver-fips 1.6.2-r0 (enterprise-packages), captured 2026-11-08 by running secrets-store-csi --help (exit 0). permalink

Usage of /usr/bin/secrets-store-csi:
  -add_dir_header
    	If true, adds the file directory to the header of the log messages
  -additional-provider-volume-paths string
    	Comma separated list of additional paths to communicate with providers (default "/etc/kubernetes/secrets-store-csi-providers")
  -alsologtostderr
    	log to standard error as well as files (no effect when -logtostderr=true)
  -alsologtostderrthreshold value
    	logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)
  -drivername string
    	name of the driver (default "secrets-store.csi.k8s.io")
  -enable-pprof
    	enable pprof profiling
  -enable-secret-rotation
    	Enable secret rotation feature [alpha]
  -endpoint string
    	CSI endpoint (default "unix://tmp/csi.sock")
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -legacy_stderr_threshold_behavior
    	If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true (default true)
  -log-format-json
    	set log formatter to json
  -log_backtrace_at value
    	when logging hits line file:N, emit a stack trace
  -log_dir string
    	If non-empty, write log files in this directory (no effect when -logtostderr=true)
  -log_file string
    	If non-empty, use this log file (no effect when -logtostderr=true)
  -log_file_max_size uint
    	Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
  -logtostderr
    	log to standard error instead of files (default true)
  -max-call-recv-msg-size int
    	maximum size in bytes of gRPC response from plugins (default 4194304)
  -metrics-addr string
    	The address the metric endpoint binds to (default ":8095")
  -metrics-backend string
    	Backend used for metrics (default "Prometheus")
  -nodeid string
    	node id
  -one_output
    	If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
  -pprof-port int
    	port for pprof profiling (default 6065)
  -provider-health-check
    	Enable health check for configured providers
  -provider-health-check-interval duration
    	Provider healthcheck interval duration (default 2m0s)
  -provider-volume string
    	Volume path for provider (default "/var/run/secrets-store-csi-providers")
  -rotation-poll-interval duration
    	Secret rotation poll interval duration (default 2m0s)
  -skip_headers
    	If true, avoid header prefixes in the log messages
  -skip_log_headers
    	If true, avoid headers when opening log files (no effect when -logtostderr=true)
  -stderrthreshold value
    	logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2)
  -v value
    	number for the log level verbosity
  -version
    	Print the version and exit
  -vmodule value
    	comma-separated list of pattern=N settings for file-filtered logging
Options (32)
OptionDescriptionSource
-add_dir_headerIf true, adds the file directory to the header of the log messageshelp
-additional-provider-volume-paths stringComma separated list of additional paths to communicate with providers (default "/etc/kubernetes/secrets-store-csi-providers")help
-alsologtostderrlog to standard error as well as files (no effect when -logtostderr=true)help
-alsologtostderrthreshold valuelogs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true)help
-drivername stringname of the driver (default "secrets-store.csi.k8s.io")help
-enable-pprofenable pprof profilinghelp
-enable-secret-rotationEnable secret rotation feature [alpha]help
-endpoint stringCSI endpoint (default "unix://tmp/csi.sock")help
-kubeconfig stringPaths to a kubeconfig.help
-legacy_stderr_threshold_behaviorIf true, stderrthreshold is ignored when logtostderr=true (legacy behavior).help
-log-format-jsonset log formatter to jsonhelp
-log_backtrace_at valuewhen logging hits line file:N, emit a stack tracehelp
-log_dir stringIf non-empty, write log files in this directory (no effect when -logtostderr=true)help
-log_file stringIf non-empty, use this log file (no effect when -logtostderr=true)help
-log_file_max_size uintDefines the maximum size a log file can grow to (no effect when -logtostderr=true).help
-logtostderrlog to standard error instead of files (default true)help
-max-call-recv-msg-size intmaximum size in bytes of gRPC response from plugins (default 4194304)help
-metrics-addr stringThe address the metric endpoint binds to (default ":8095")help
-metrics-backend stringBackend used for metrics (default "Prometheus")help
-nodeid stringnode idhelp
-one_outputIf true, only write logs to their native severity level (vs also writing to each lower severity level;help
-pprof-port intport for pprof profiling (default 6065)help
-provider-health-checkEnable health check for configured providershelp
-provider-health-check-interval durationProvider healthcheck interval duration (default 2m0s)help
-provider-volume stringVolume path for provider (default "/var/run/secrets-store-csi-providers")help
-rotation-poll-interval durationSecret rotation poll interval duration (default 2m0s)help
-skip_headersIf true, avoid header prefixes in the log messageshelp
-skip_log_headersIf true, avoid headers when opening log files (no effect when -logtostderr=true)help
-stderrthreshold valuelogs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2)help
-v valuenumber for the log level verbosityhelp
-versionPrint the version and exithelp
-vmodule valuecomma-separated list of pattern=N settings for file-filtered logginghelp

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.