<p>EDIT:
It was a config error, I was setting wrong kv name :/</p>
<p>As said in title I'm facing an issue with secret creation using SecretProviderClass.</p>
<p>I've created my aks and my kv (and filled it) on azure. then I'll proceed to follow <a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver" rel="nofollow noreferrer">those</a> steps using a user-assigned managed identity</p>
<p>but no <code>secret</code> resource get created and pods got stuck on creation with mount failure.</p>
<p>those are the steps I followed</p>
<pre><code>az extension add --name aks-preview
az extension update --name aks-preview
az aks enable-addons --addons azure-keyvault-secrets-provider -g $RESOURCE_GROUP -n $AKS_CLUSTER 
az aks update -g $RESOURCE_GROUP -n $AKS_CLUSTER --enable-managed-identity --disable-secret-rotation
$AKS_ID = (az aks show -g $RESOURCE_GROUP -n $AKS_CLUSTER --query identityProfile.kubeletidentity.clientId -o tsv)
az keyvault set-policy -n $AZUREKEYVAULT --secret-permissions get --spn $AKS_ID
</code></pre>
<p>the SecretProviderClass manifest I'm using</p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-kvname
spec:
  provider: azure
  secretObjects:
  - secretName: akvsecrets
    type: Opaque
    data:
    - objectName: AzureSignalRConnectionString 
      key: AzureSignalRConnectionString
    - objectName: BlobStorageConnectionString 
      key: BlobStorageConnectionString
    - objectName: SqlRegistryConnectionString 
      key: SqlRegistryConnectionString
    - objectName: TokenSymmetricKey 
      key: TokenSymmetricKey
  parameters:
    useVMManagedIdentity: &quot;true&quot;
    userAssignedIdentityID: XXX # VMSS UserAssignedIdentity
    keyvaultName: &quot;sampleaks001&quot; # the name of the KeyVault
    objects:  |
      array:
        - |
          objectName: AzureSignalRConnectionString
          objectType: secret
        - |
          objectName: BlobStorageConnectionString
          objectType: secret
        - |
          objectName: SqlRegistryConnectionString
          objectType: secret
        - |
          objectName: TokenSymmetricKey
          objectType: secret
    resourceGroup: sample # [REQUIRED for version &lt; 0.0.4] the resource group of the KeyVault
    subscriptionId: XXXX # [REQUIRED for version &lt; 0.0.4] the subscription ID of the KeyVault
    tenantId: XXX # the tenant ID of the KeyVault  
</code></pre>
<p>and the deploy manifest</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: trm-api-test
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: trm-api-test
  template:
    metadata:
      labels:
        app: trm-api-test
    spec:
      nodeSelector:
        &quot;kubernetes.io/os&quot;: linux
      containers:
      - name: trm-api-test
        image: nginx
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 250m
            memory: 256Mi
        ports:
        - containerPort: 80
        env:
        - name: AzureSignalRConnectionString
          valueFrom:
            secretKeyRef:
              name: akvsecrets
              key: AzureSignalRConnectionString
        - name: TokenSymmetricKey
          valueFrom:
            secretKeyRef:
              name: akvsecrets
              key: TokenSymmetricKey
        - name: BlobStorageConnectionString
          valueFrom:
            secretKeyRef:
              name: akvsecrets
              key: BlobStorageConnectionString
        - name: SqlRegistryConnectionString
          valueFrom:
            secretKeyRef:
              name: akvsecrets
              key: SqlRegistryConnectionString
        volumeMounts:
        - name: secrets-store-inline
          mountPath: &quot;/mnt/secrets-store&quot;
          readOnly: true
      volumes:
        - name: secrets-store-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: &quot;azure-kvname&quot;
---
apiVersion: v1
kind: Service
metadata:
  name: trm-api-service-test
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: trm-api-test
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
</code></pre>
<p>I'm sure I'm missing something, but can't understand what.
Thanks in advance!</p>

Michele Ietri
<p>you are using the clientId, but it should be the objectId form the kubelet identity:</p>
<pre><code>export KUBE_ID=$(az aks show -g &lt;resource group&gt; -n &lt;aks cluster name&gt; --query identityProfile.kubeletidentity.objectId -o tsv)
export AKV_ID=$(az keyvault show -g &lt;resource group&gt; -n &lt;akv name&gt; --query id -o tsv)
az role assignment create --assignee $KUBE_ID --role &quot;Key Vault Secrets Officer&quot; --scope $AKV_ID
</code></pre>
<p>This is a working SecretProviderClass i am using (adjusted to your config):</p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-kvname
spec:
  provider: azure
  secretObjects:
  - data:
    - objectName: AzureSignalRConnectionString 
      key: AzureSignalRConnectionString
    - objectName: BlobStorageConnectionString 
      key: BlobStorageConnectionString
    - objectName: SqlRegistryConnectionString 
      key: SqlRegistryConnectionString
    - objectName: TokenSymmetricKey 
      key: TokenSymmetricKey
    secretName: akvsecrets
    type: Opaque
  parameters:
    usePodIdentity: &quot;false&quot;
    useVMManagedIdentity: &quot;true&quot;
    userAssignedIdentityID: XXX # Kubelet Client Id ( Nodepool Managed Idendity )
    keyvaultName: &quot;sampleaks001&quot; # the name of the KeyVault
    tenantId: XXX # the tenant ID of the KeyVault  
    objects:  |
      array:
        - |
          objectName: AzureSignalRConnectionString
          objectAlias: AzureSignalRConnectionString
          objectType: secret
        - |
          objectName: BlobStorageConnectionString
          objectAlias: BlobStorageConnectionString
          objectType: secret
        - |
          objectName: SqlRegistryConnectionString
          objectAlias: SqlRegistryConnectionString
          objectType: secret
        - |
          objectName: TokenSymmetricKey
          objectAlias: TokenSymmetricKey
          objectType: secret
</code></pre>
<p>You can also check documentation <a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/sync-with-k8s-secrets/" rel="nofollow noreferrer">here</a> as you will find better examples as on the Azure Docs.</p>
