kind: Pod
apiVersion: v1
metadata:
  name: nginx-secrets-store-inline
spec:
  containers:
    - image: nginx
      name: nginx
      volumeMounts:
        - name: secrets-store-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.com
        readOnly: true
        volumeAttributes:
          providerName: "azure"
          usePodIdentity: "false" # [OPTIONAL] if not provided, will default to "false"
          keyvaultName: "$KEYVAULT_NAME" # the name of the KeyVault
          objects: |
            array:
              - |
                objectName: $SECRET_NAME
                objectType: secret        # object types: secret, key or cert
                objectVersion: $SECRET_VERSION         # [OPTIONAL] object versions, default to latest if empty
              - |
                objectName: $KEY_NAME
                objectType: key
                objectVersion: $KEY_VERSION
          resourceGroup: "$RESOURCE_GROUP" # the resource group of the KeyVault
          subscriptionId: "$SUBSCRIPTION_ID" # the subscription ID of the KeyVault
          tenantId: "$TENANT_ID" # the tenant ID of the KeyVault
        nodePublishSecretRef:
          name: secrets-store-creds
