<p>The documentation is a bit confusing there are two sets:</p>
<ul>
<li><a href="https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-integrate-kubernetes</a></li>
<li><a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/identity-access-modes/pod-identity-mode/" rel="nofollow noreferrer">https://azure.github.io/secrets-store-csi-driver-provider-azure/configurations/identity-access-modes/pod-identity-mode/</a></li>
</ul>
<p>At any rate, I'm able to do the following to see that secrets are in the Pod:</p>
<pre><code>kubectl exec -it nginx-secrets-store-inline -- ls /mnt/secrets-store/
kubectl exec -it nginx-secrets-store-inline -- cat /mnt/secrets-store/secret1
</code></pre>
<p>This is basically where the documentation and tutorials I've seen end.</p>
<p>Cool... but what needs to be done to get them into the environmental variables in the application running in the Pod?</p>
<p>For example, this is how my API deployment is setup from when I was doing <code>kubectl create secret generic app-secrets --from-literal=PGUSER=$pguser...</code>:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-deployment-dev
  namespace: production
spec:
  replicas: 3
  revisionHistoryLimit: 5
  selector:
    matchLabels:
      component: api
  template:
    metadata:
      labels:
        component: api
    spec:
      containers:
        - name: api
          image: api
          ports:
            - containerPort: 5000
          env:
            - name: PGDATABASE
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGDATABASE
            - name: PGHOST
              value: postgres-cluster-ip-service-dev
            - name: PGPORT
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGPORT
            - name: PGUSER
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGUSER
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: k8stut-dev-secrets
                  key: PGPASSWORD
          volumeMounts:
            - mountPath: /mnt/file-storage
              name: file-storage-dev
              subPath: file-storage
      volumes:
        - name: file-storage-dev
          persistentVolumeClaim:
            claimName: file-storage-dev
---
apiVersion: v1
kind: Service
metadata:
  name: api-cluster-ip-service-dev
  namespace: development
spec:
  type: ClusterIP
  selector:
    component: api
  ports:
    - port: 5000
      targetPort: 5000
</code></pre>
<p>What needs to be done now with all of these?</p>
<pre><code>env:
  - name: PGDATABASE
    valueFrom:
      secretKeyRef:
        name: k8stut-dev-secrets
        key: PGDATABASE
</code></pre>

cjones
<p>The answer above by Patrick helped, but is not fully correct. AKS provides support as well to &quot;sync&quot; Key Vault Secrets into Kubernetes Secrets which can be used as ENV variables.</p>
<p>See the microsoft docs on how to setup sync of a secret into kubernetes:
<a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#sync-mounted-content-with-a-kubernetes-secret" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#sync-mounted-content-with-a-kubernetes-secret</a></p>
<p>And this article shows how you can reference the secret into an environment variable:
<a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#set-an-environment-variable-to-reference-kubernetes-secrets" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver#set-an-environment-variable-to-reference-kubernetes-secrets</a></p>
