keyvault-csi-driver

Use the Secrets Store CSI Driver to mount Key Vault secrets directly into pods as files or sync them to Kubernetes Secrets. Create a SecretProviderClass resource that maps Key Vault objects to pod volumes, authenticate via managed identity, and the driver handles injection without storing credentials in your cluster.

Yes. Managed identity eliminates hardcoded credentials by allowing pods to authenticate to Key Vault securely. Configure your pod identity and grant it RBAC or access policy permissions on Key Vault, then reference it in your SecretProviderClass for automatic authentication.

The Secrets Store CSI Driver supports automatic rotation of Key Vault secrets. Mount secrets as files in pods—the driver refreshes them at configurable intervals—and optionally sync rotated secrets to Kubernetes Secrets so dependent applications stay current without manual restarts.

Verify your pod identity has RBAC or access policy permissions on the Key Vault and specific secrets or certificates. Check SecretProviderClass configuration for correct Key Vault name and object references, and confirm managed identity is properly bound to your pod and workload.

Yes. Create SecretProviderClass resources in each namespace and cluster, all pointing to the same Key Vault. Use managed identities scoped to each cluster, grant appropriate RBAC permissions per cluster, and the CSI Driver handles namespace-isolated secret injection consistently.

No. Key Vault stores certificates, keys, and secrets in a single vault. The Secrets Store CSI Driver maps any object type—certificate, key, or secret—to your SecretProviderClass and injects them as files or synced Kubernetes Secrets with the same mechanism.