Nice job!
Have you looked into CSI Ephemeral Volumes? KEP-596
Essentially they allow you to skip creating SCs and just stick the entire volume spec into the podspec. NodePublishVolume has support for receiving secret references as well so you can leave secrets out of StorageClass or Podspec.
Iām gonna give your CSI a shot this week for my awayfromhomelab 
(Just found it and this post now)