kind: Pod
apiVersion: v1
metadata:
  name: nginx-secrets-store-inline-pod-identity
  labels:
    aadpodidbinding: "NAME OF the AzureIdentityBinding SELECTOR"
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - name: secrets-store-inline
      mountPath: "/mnt/secrets-store"
      readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.com
        readOnly: true
        volumeAttributes:
          providerName: "azure"
          usePodIdentity: "true"          # [OPTIONAL] if not provided, will default to "false"
          keyvaultName: ""                # the name of the KeyVault
          objects:  |
            array:
              - |
                objectName: secret1
                objectType: secret        # object types: secret, key or cert
                objectVersion: ""         # [OPTIONAL] object versions, default to latest if empty
              - |
                objectName: key1
                objectType: key
                objectVersion: ""
          resourceGroup: ""               # the resource group of the KeyVault
          subscriptionId: ""              # the subscription ID of the KeyVault
          tenantId: ""                    # the tenant ID of the KeyVault