apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-secrets-store
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadOnlyMany
  persistentVolumeReclaimPolicy: Retain
  csi:
    driver: secrets-store.csi.k8s.io
    readOnly: true
    volumeHandle: kv
    volumeAttributes:
      providerName: "azure"
      usePodIdentity: "false"         # [OPTIONAL] default to "false" if empty
      keyvaultName: ""                # name of the KeyVault
      cloudName: "cloudname"          # [OPTIONAL for Azure] if not provided, azure environment will default to AzurePublic 
      objects:  |
        array:                        # array of objects
          - |
            objectName: secret1
            objectType: secret        # object types: secret, key or cert
            objectVersion: ""         # [OPTIONAL] object versions, default to latest if empty
          - |
            objectName: key1
            objectType: key
            objectVersion: ""
      resourceGroup: ""               # [REQUIRED for version < 0.0.4] resource group of the KeyVault
      subscriptionId: ""              # [REQUIRED for version < 0.0.4] subscription ID of the KeyVault
      tenantId: ""                    # tenant ID of the KeyVault
    nodePublishSecretRef:
      name: secrets-store-creds
      namespace: default
