<p>By using the reference of <a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-nginx-tls" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-nginx-tls</a> this document, I'm trying to fetch the TLS secrets from AKV to AKS pods.
Initially I created and configured <strong>CSI driver configuration</strong> with using <strong>User Assigned Managed Identity</strong>.</p>
<p>I have performed the following steps:</p>
<ul>
<li>Create AKS Cluster with 1 nodepool.</li>
<li>Create AKV.</li>
<li>Created user assigned managed identity and assign it to the nodepool i.e. to the VMSS created for AKS.</li>
<li>Installed CSI Driver helm chart in AKS's <strong>&quot;kube-system&quot;</strong> namespace. and completed all the requirement to perform this operations.</li>
<li>Created the TLS certificate and key.</li>
<li>By using TLS certificate and key, created .pfx file.</li>
<li>Uploaded that .pfx file in the AKV certificates named as <strong>&quot;ingresscert&quot;</strong>.</li>
<li>Created new namespace in AKS named as &quot;ingress-test&quot;.</li>
<li>Deployed secretProviderClass in that namespace are as follows.:</li>
</ul>
<pre><code>apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-tls
spec:
  provider: azure
  secretObjects:                            # secretObjects defines the desired state of synced K8s secret objects
  - secretName: ingress-tls-csi
    type: kubernetes.io/tls
    data: 
    - objectName: ingresscert
      key: tls.key
    - objectName: ingresscert
      key: tls.crt
  parameters:
    usePodIdentity: &quot;false&quot;
    useVMManagedIdentity: &quot;true&quot;
    userAssignedIdentityID: &quot;7*******-****-****-****-***********1&quot;
    keyvaultName: &quot;*****-*****-kv&quot;                 # the name of the AKV instance
    objects: |
      array:
        - |
          objectName: ingresscert
          objectType: secret
    tenantId: &quot;e*******-****-****-****-***********f&quot;                    # the tenant ID of the AKV instance
</code></pre>
<ul>
<li>Deployed the <strong>nginx-ingress-controller</strong> helm chart in the same namespace, where certificates are binded with application.</li>
<li>Deployed the Busy Box deployment are as follows:</li>
</ul>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: busybox-one
  labels:
    app: busybox-one
spec:
  replicas: 1
  selector:
    matchLabels:
      app: busybox-one
  template:
    metadata:
      labels:
        app: busybox-one
    spec:
      containers:
        - name: busybox
          image: k8s.gcr.io/e2e-test-images/busybox:1.29-1
          command:
            - &quot;/bin/sleep&quot;
            - &quot;10000&quot;
          volumeMounts:
            - name: secrets-store-inline
              mountPath: &quot;/mnt/secrets-store&quot;
              readOnly: true
      volumes:
        - name: secrets-store-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: &quot;azure-tls&quot;
---
apiVersion: v1
kind: Service
metadata:
  name: busybox-one
spec:
  type: ClusterIP
  ports:
    - port: 80
  selector:
    app: busybox-one
</code></pre>
<ul>
<li>Check secret is created or not by using command</li>
</ul>
<pre><code>kubectl get secret -n &lt;namespaceName&gt;
</code></pre>
<p><strong>One thing to notice here is, if I attach shell with the busy box pod and go to the mount path which I provided to mount secrets I have seen that secrets are successfully fetched there. But this secrets are not showing in the AKS's secret list.</strong></p>
<p>I have troubleshooted all the AKS,KV and manifest files but not found anything.
IF there is anything I have missed or anyone has solution for this please let me know.</p>
<p>Thanks in advance..!!!</p>

Kaivalya Dambalkar
<p>i added this as a new answer, bcs the formatting was bad in the comments:</p>
<p>As you are using the Helm chart, you have to activate the secret sync in the <code>values.yaml</code> of the Helm Chart:</p>
<pre><code>secrets-store-csi-driver:
  syncSecret:
    enabled: true
</code></pre>
<p>I would still recommend to use the <code>csi-secrets-store-provider-azure</code> as AKS Addon instead of the Helm-Chart</p>
