<p>I have an Asp.Net Core application that is configured to connect to Azure KeyVault using Visual Studio 2019 Connected Services:</p>
<p><a href="https://learn.microsoft.com/en-us/azure/key-vault/general/vs-key-vault-add-connected-service" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/key-vault/general/vs-key-vault-add-connected-service</a></p>
<p>I containerized the application with Docker and deployed it into Kubernetes as a Pod.
The KeyVault connection is not working, probably because of the Managed Identity not set-up.</p>
<p>I tried:</p>
<ol>
<li>Added the Kubernetes agent Managed Identity to the KeyVault Acccess policies like I would do with App Services or Container Services, but does not allow the connection.</li>
<li>Followed the docs here: <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes</a></li>
</ol>
<p>I wonder if the &quot;Azure Key Vault provider for the Secrets Store CSI driver on Kubernetes&quot; is the right way to use KeyVault from a pod, or if there is a simpler solution like a direct connection.</p>

Francesco Cristallo
<p>The solution, for whoever is in my situation, is to use <a href="https://github.com/Azure/aad-pod-identity" rel="nofollow noreferrer">AAD-Pod Identity</a></p>
<p>There is no need to attach a CSI Driver unless you need the Secrets in the Kubernetes configuration, want total control on custom configurations, or have the cluster outside Azure.</p>
<p>For Asp.Net Core applications deployed to AKS, the easiest way is to use Managed Identities, and to provide that to your Kubernetes Cluster you need AAD-Pod identity.</p>
<p>There is not a documentation page yet, but following the Get Started instructions on GitHub is enough to get it going.</p>
