<p>EDIT: Found the issue.I didnt installed the addon for secret driver. Once installed that i was able to make it work</p>
<p>I am facing an issue here and i have no idea what else i can try to figure out the issue.</p>
<p>I have an aks running with a single pod that runs a basic web app <code>todo list</code>. Nothing too fancy or complicated. what i am trying to do here, is to give permission to the aks cluster to access a keyvault and <code>GET</code> a secret to pass to the pod. the secret is just an <code>ASPNETCORE_ENVIRONMENT: Development</code>.</p>
<p>Following the documentations, i used helm to install the repo:</p>
<pre><code>helm repo add csi-secrets-store-provider-azure https://azure.github.io/secrets-store-csi-driver-provider-azure/charts
helm install csi csi-secrets-store-provider-azure/csi-secrets-store-provider-azure
</code></pre>
<p>I created a Service Principle in azure:
<code>SERVICE_PRINCIPLE_CLIENT_SECRET = az ad sp create-for-rbac --skip-assignment --name sp-aks-keyvault</code></p>
<p>i queried the clientId and Secret and passed them to my cluster as follow:</p>
<pre><code>kubectl create secret generic secrets-store-creds --from-literal clientid=&quot;ClientID&quot; --from-literal clientsecret=&quot;Password&quot;
</code></pre>
<p>Once everything was set. I set those deployments.</p>
<p>Deployment.yaml</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp-deployment
  namespace: default
  labels:
    app: webapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      containers:
        - name: webapp
          image: dockerimage-acr
          ports:
            - containerPort: 80
          env:
          - name: ASPNETCORE_ENVIRONMENT
            valueFrom:
              secretKeyRef:
                name: aspenet-environment
                key: environment
          securityContext:
            allowPrivilegeEscalation: false
          volumeMounts:
          - name: secrets-mount
            mountPath: &quot;/mnt/secrets-store&quot;
            readOnly: true
      restartPolicy: Always 
      volumes:
        - name: secrets-mount
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: &quot;kv-name&quot;
            nodePublishSecretRef:                       # Only required when using service principal mode
              name: secrets-store-creds    
</code></pre>
<p>And my secretProvider.yaml</p>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: keyvault-secret-class
  namespace: default
spec:
  provider: azure
  secretObjects:
    - secretName: aspenet-environment
      type: Opaque
      data:
      - objectName: aspnetcoreenvironment
        key: environment
  parameters:
    usePodIdentity: &quot;false&quot;
    useVMManagedIdentity: &quot;false&quot;
    userAssignedIdentityID: &quot;&quot;
    keyvaultName: &quot;mykeyvault-name&quot;
    objects: |
      array:
        - |
          objectName: aspnetcoreenvironment
          objectType: secret
          objectVersion: &quot;&quot;
    tenantId: &quot;&lt;Tenant-Id&gt;&quot;
</code></pre>
<p>In my keyvault i gave access policy to the Service principle created and assigned <code>Secret Permissions: GET</code> and created a secret called</p>
<pre><code>Name: aspnetcoreenvironment
value: Development
</code></pre>
<p>So far everything went ok, but when i run the deployment. and use the command <code>kubectl describe pod &lt;podname&gt;</code> i see the error, that prevents the container to start</p>
<pre><code>Warning  Failed     8s (x3 over 21s)  kubelet            Error: secret &quot;aspenet-environment&quot; not found
</code></pre>
<p>I tried different solutions but nothing works.
if i run the command <code>kubectl get secretproviderclass</code> i get back my provider i created.
As far as i understand, if no service is requiring a specific secret, i wont be able to find the secret i want to create if i run the command: <code>kubectl get secret</code></p>
<p>And this is correct, i guess, because my pod is not starting.</p>
<p>Any help or enlightenment here about what i am doing wrong or how to fix it?</p>
<p>Thank you so much guys</p>
<p>EDIT:
Some extra debugging i came across the fact that the volume mount is still required. So i did add the volume to the deployment. But this is still giving an error.</p>
<p>The issue is, as i realized. Is when i run the command <code>kubectl apply -f secretProviderClass.yml</code>, no secret get created at all, reason why is failing.
So i think something is wrong here. Applying the SecretProviderClass shouldnt create automatically a <code>secret</code> service?</p>

Nayden Van
<p>The creation of SecretProviderClass object does not automatically create the secret within kubernetes. The <code>secret</code> object gets created only when there is an actual pod running within the cluster which is utilising the defined <strong>SecretProviderClass</strong>.</p>
<p>This behaviour is documented under:
<a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver" rel="noreferrer">https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver</a></p>
<p><strong>Sync mounted content with a Kubernetes secret</strong></p>
<p><code>You might want to create a Kubernetes secret to mirror your mounted secrets content. Your secrets will sync after you start a pod to mount them. When you delete the pods that consume the secrets, your Kubernetes secret will also be deleted.</code></p>
