kind: Pod
apiVersion: v1
metadata:
  name: nginx-secrets-store-inline
spec:
  containers:
    - image: $CONTAINER_IMAGE
      name: nginx
      volumeMounts:
        - name: secrets-store-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          providerName: "azure"
          usePodIdentity: "false"         # [OPTIONAL] if not provided, will default to "false"
          keyvaultName: "$KEYVAULT_NAME" # the name of the KeyVault
          objects: |
            array:
              - |
                objectName: $OBJECT1_NAME
                objectType: $OBJECT1_TYPE       # object types: secret, key or cert
                objectVersion: $OBJECT1_VERSION         # [OPTIONAL] object versions, default to latest if empty
              - |
                objectName: $OBJECT2_NAME
                objectType: $OBJECT2_TYPE
                objectVersion: $OBJECT2_VERSION
              - |
                objectName: $OBJECT1_NAME
                objectAlias: $OBJECT1_ALIAS
                objectType: $OBJECT1_TYPE
                objectVersion: $OBJECT1_VERSION
              - |
                objectName: $OBJECT2_NAME
                objectAlias: $OBJECT2_ALIAS
                objectType: $OBJECT2_TYPE
                objectVersion: $OBJECT2_VERSION
          tenantId: "$TENANT_ID" # the tenant ID of the KeyVault
        nodePublishSecretRef:
          name: secrets-store-creds
