<p>The documentation is a bit confusing there are two sets:</p>
<ul>
<li><a href="https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes</a></li>
<li><a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/identity-access-modes/pod-identity-mode/" rel="nofollow noreferrer">https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/identity-access-modes/pod-identity-mode/</a></li>
</ul>
<p>At any rate, I'm able to do the following to see that secrets are in the Pod:</p>
<pre><code>kubectl exec -it nginx-secrets-store-inline -- ls /mnt/secrets-store/
kubectl exec -it nginx-secrets-store-inline -- cat /mnt/secrets-store/secret1
</code></pre>
<p>This is basically where the documentation and tutorials I've seen end.</p>
<p>Cool... but what needs to be done to get them into the environmental variables in the application running in the Pod?</p>
<p>For example, this is how my API deployment is setup from when I was doing <code>kubectl create secret generic app-secrets --from-literal=PGUSER=$pguser...</code>:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-deployment-dev
  namespace: production
spec:
  replicas: 3
  revisionHistoryLimit: 5
  selector:
    matchLabels:
      component: api
  template:
    metadata:
      labels:
        component: api
    spec:
      containers:
        - name: api
          image: api
          ports:
            - containerPort: 5000
          env:
            - name: PGDATABASE
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGDATABASE
            - name: PGHOST
              value: postgres-cluster-ip-service-dev
            - name: PGPORT
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGPORT
            - name: PGUSER
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGUSER
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGPASSWORD
          volumeMounts:
            - mountPath: /mnt/file-storage
              name: file-storage-dev
              subPath: file-storage
      volumes:
        - name: file-storage-dev
          persistentVolumeClaim:
            claimName: file-storage-dev
---
apiVersion: v1
kind: Service
metadata:
  name: api-cluster-ip-service-dev
  namespace: development
spec:
  type: ClusterIP
  selector:
    component: api
  ports:
    - port: 5000
      targetPort: 5000
</code></pre>
<p>What needs to be done now with all of these?</p>
<pre><code>env:
  - name: PGDATABASE
    valueFrom:
      secretKeyRef:
        name: k8stut-dev-secrets
        key: PGDATABASE
</code></pre>

<p>The CSI secret store driver is a container <em>storage</em> interface driver - it can only mount to files.</p>
<p>For postgres specifically, you can use <a href="https://hub.docker.com/_/postgres#:%7E:text=_FILE%20may%20be%20appended" rel="nofollow noreferrer">docker secrets environment variables</a> to point to the path you're mounting the secret in and it will read it from the file instead. This works via appending _FILE to the variable name.</p>
<p>Per that document: <code>Currently, this is only supported for POSTGRES_INITDB_ARGS, POSTGRES_PASSWORD, POSTGRES_USER, and POSTGRES_DB.</code></p>
<pre class="lang-yaml prettyprint-override"><code>- name: POSTGRES_DB_FILE
  value: /mnt/secrets-store/db-secret
</code></pre>
<p>In the general case, if you need the secrets in environment variables, I would typically use a startup script in the container to read the CSI mounted secrets and export them. If it's a custom container this is usually easy enough to add; if it's a standard container you may be able to <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/" rel="nofollow noreferrer">override the command</a> with a small set of shell commands that can export the appropriate variables by reading the files before calling whatever the normal ENTRYPOINT of the container would have been.</p>
