<p>Below is my app definition that uses <a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/docs/demos/" rel="nofollow noreferrer">azure csi store provider</a>. Unfortunately, this definition throws <code>Error: secret 'my-kv-secrets' not found</code> why is that?</p>
<h3>SecretProviderClass</h3>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: my-app-dev-spc
spec:
  provider: azure
  secretObjects:
  - secretName: my-kv-secrets
    type: Opaque
    data: 
    - objectName: DB-HOST
      key: DB-HOST
  parameters:
    keyvaultName: my-kv-name
    objects: |
      array:
        - |
          objectName: DB-HOST
          objectType: secret
    tenantId: &quot;xxxxx-yyyy-zzzz-rrrr-vvvvvvvv&quot;
</code></pre>
<h3>Pod</h3>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  labels:
    run: debug
  name: debug
spec:
  containers:
  - args:
    - sleep
    - 1d
    name: debug
    image: alpine
    env:
    - name: DB_HOST
      valueFrom:
        secretKeyRef:
          name: my-kv-secrets
          key: DB-HOST
  volumes:
  - name: kv-secrets
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: my-app-dev-spc
      nodePublishSecretRef:
        name: my-sp-secrets
</code></pre>

<p>It turned out that secrets store csi  works only with <code>volumeMounts</code>. So if you forget to specify it in your yaml definition then it will not work! Below is fix.</p>
<h3>Pod</h3>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  labels:
    run: debug
  name: debug
spec:
  containers:
  - args:
    - sleep
    - 1d
    name: debug
    image: alpine
    env:
    - name: DB_HOST
      valueFrom:
        secretKeyRef:
          name: my-kv-secrets
          key: DB-HOST
    volumeMounts:
    - name: kv-secrets
      mountPath: /mnt/kv_secrets
      readOnly: true
  volumes:
  - name: kv-secrets
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: my-app-dev-spc
      nodePublishSecretRef:
        name: my-sp-secrets
</code></pre>
