kind: Pod
apiVersion: v1
metadata:
  name: nginx-secrets-store-inline
spec:
  containers:
    - image: nginx
      name: nginx
      volumeMounts:
        - name: secrets-store-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          providerName: "azure"
          usePodIdentity: "false"         # [OPTIONAL] if not provided, will default to "false"
          keyvaultName: "$KEYVAULT_NAME" # the name of the KeyVault
          objects: |
            array:
              - |
                objectName: $SECRET_NAME
                objectType: secret
                objectVersion: $SECRET_VERSION
              - |
                objectName: $KEY_NAME
                objectType: key
                objectVersion: $KEY_VERSION
              - |
                objectName: $SECRET_NAME
                objectAlias: $SECRET_ALIAS
                objectType: secret
                objectVersion: $SECRET_VERSION
              - |
                objectName: $KEY_NAME
                objectAlias: $KEY_ALIAS
                objectType: key
                objectVersion: $KEY_VERSION
              - |
                objectName: $CERT1_NAME
                objectType: cert
                objectVersion: $CERT1_VERSION
              - |
                objectName: $CERT2_NAME
                objectType: cert
                objectVersion: $CERT2_VERSION
          tenantId: "$TENANT_ID" # the tenant ID of the KeyVault
        nodePublishSecretRef:
          name: secrets-store-creds
