Using an Image Volume to deploy certifiats

[finkr]

Truststore can be quite large. pushing it for every application can put unnecessary load on the Kubernetes etcd database.

Are the any plans to use the Kubernetes 1.31 new Image Volume With a Pod feature to store truststore in a container image ?

[erikgb]

Hi @finkr! Thanks for opening up this issue. Could you elaborate on how trust-manager could use the upstream feature you are referring to? If you are familiar with trust-manager, you probably know the Bundle (to-be ClusterBundle) resource. We currently support ConfigMap and Secret targets, and ClusterTrustBundle is already on our radar, as referenced. #591.

We are not planning to add any Pod admission controller. To utilize the feature you are referring to, we would need to build and push an image from within the trust-manager controller. Where should the controller push the image? We have an experimental CSI driver providing trust bundles as CSI volumes, https://github.com/cert-manager/trust-manager-csi-driver. Could it solve your use case? CC: @ThatsMrTalbot