<p>I'm setting up Keyvault integration with k8s in Azure.  I can mount a volume with secrets using the csi driver in Azure using Managed identities. I can verify the secret is mounted by exec-ing into the pod and cat-ing out the secrets. However, now I want to expose the secrets as environment variables, but I'm unclear how to do that.  Below is the following <code>SecretProviderClass</code> and <code>Pod</code> I have deployed.</p>
<p>spc-keyvault.yaml:</p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: spc-keyvault
spec:
  provider: azure
  secretObjects:
  - secretName: foobar-secret
    data:
    - key: foobar
      objectName: foobar
    type: Opaque
  parameters:
    keyvaultName: &quot;$keyvault&quot;
    usePodIdentity: &quot;true&quot;
    useVMManagedIdentity: &quot;false&quot;
    userAssignedIdentityID: &quot;&quot;
    cloudName: &quot;&quot;
    objects: |
      array:
        - |
          objectName: foobar
          objectType: secret
          objectVersion: &quot;&quot;
    resourceGroup: &quot;$resourceGroup&quot;
    subscriptionId: &quot;$subId&quot;
    tenantId: &quot;$tenantId&quot;
</code></pre>
<p>pod.yaml:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: inject-secrets-from-akv
  labels:
    aadpodidbinding: azure-pod-identity-binding-selector
spec:
  containers:
    - name: nginx
      image: nginx
      env:
      - name: SECRET
        valueFrom:
          secretKeyRef:
            name: foobar-secret
            key: foobar
      volumeMounts:
      - name: secrets-store-inline
        mountPath: &quot;/mnt/secrets-store&quot;
        readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: spc-keyvault
</code></pre>
<p>Here's the error when I deploy my Pod manifest:</p>
<pre><code>Events:
  Type     Reason   Age                     From     Message
  ----     ------   ----                    ----     -------
  Warning  Failed   58m (x227 over 108m)    kubelet  Error: secret &quot;foobar-secret&quot; not found
  Normal   Pulling  3m51s (x470 over 108m)  kubelet  Pulling image &quot;nginx&quot;
</code></pre>
<p>The error is pretty obvious, there is no secret named: <code>foobar-secret</code>. I thought the csi driver automatically created the required secrets.  So after some research and digging throught documentation and source code, I found a suggestion to add <code>nodePublishSecretRef</code> in the pod yaml. Then you need to set <code>nodePublishSecretRef</code> with the aad client id and client secret.[1, 2]  However since I'm using managed identity I'm unsure how to do this.</p>
<p>Has anyone got this working using Managed Identity and can provide any insight?  Or do i need to create a startup script (via configmap?) to populate the volume mount as env. variables.</p>
<ol>
<li><a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/identity-access-modes/service-principal-mode/" rel="nofollow noreferrer">https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/identity-access-modes/service-principal-mode/</a></li>
<li><a href="https://medium.com/swlh/integrate-azure-key-vault-with-azure-kubernetes-service-1a8740429bea" rel="nofollow noreferrer">https://medium.com/swlh/integrate-azure-key-vault-with-azure-kubernetes-service-1a8740429bea</a></li>
</ol>

<p>After more digging around, I found this bit to tickle in the helm chart to get the csi driver to create k8s secrets:</p>
<pre><code>secrets-store-csi-driver.syncSecret.enabled = true
</code></pre>
<p>Now I have k8s secrets. Figured I would share for anyone else wanting this functionality.</p>
