Overriding Vault connection details using tenant ConfigMap

The Vault connections details can be reconfigured per tenant by creating a ConfigMap in the Openshift namespace with configuration options that differ from the values set in the csi-kms-connection-details ConfigMap in the openshift-storage namespace. The ConfigMap needs to be located in the tenant namespace. The values in the ConfigMap in the tenant namespace will override the values set in the csi-kms-connection-details ConfigMap for the encrypted Persistent Volumes created in that namespace.


  1. Ensure that you are in the tenant namespace.
  2. Click on Workloads > ConfigMaps > Create ConfigMap.
  3. Edit the YAML file.
    The following is a sample YAML. The values to be overidden for the given tenant namespace can be specified under the data section as shown below:
    apiVersion: v1
    kind: ConfigMap
      name: ceph-csi-kms-config
      vaultAddress: "<vault_address:port>"
      vaultBackendPath: "<backend_path>"
      vaultTLSServerName: "<vault_tls_server_name>"
      vaultNamespace: "<vault_namespace>"
  4. Click Create.