Your AKS-hosted application needs a TLS certificate and a database password. The values must be sourced from Azure Key Vault at pod startup via a mounted volume rather than stored in etcd. For select environments, you also want these values available as Kubernetes Secrets for use as environment variables. What should you configure?

The correct option leverages the Azure Key Vault provider for the Secrets Store CSI Driver, which allows pods to mount secrets from Key Vault as a volume. This fulfills the requirement for values sourced at pod startup via a mounted volume. The secretObjects configuration within the SecretProviderClass allows specific Key Vault items to be synchronized as native Kubernetes Secrets, making them available as environment variables for select environments. Storing values in a Kubernetes ConfigMap is incorrect because ConfigMaps are not designed for sensitive data like TLS certificates or passwords. Creating Kubernetes Secrets and using a custom admission controller is an overly complex and less integrated solution compared to the CSI driver. Baking secrets into the container image is insecure and impractical for rotation, as it requires image rebuilds and redeployments for every change.