Merge pull request #259461 from CocoWang-wql/patch-50

Update csi-secrets-store-driver.md

Author: prmerger-automator[bot]

articles/aks/csi-secrets-store-driver.md

@@ -4,7 +4,7 @@ description: Learn how to use the Azure Key Vault provider for Secrets Store CSI
 author: nickomang 
 ms.author: nickoman
 ms.topic: how-to 
-ms.date: 10/19/2023
+ms.date: 12/06/2023
 ms.custom: template-how-to, devx-track-azurecli, devx-track-linux
 ---
 
@@ -68,6 +68,9 @@ A container using *subPath volume mount* doesn't receive secret updates when it'
         }
     ```
 
+> [!NOTE]
+> After you enable this feature, AKS creates a managed `identity named azurekeyvaultsecretsprovider-xxx` in the node resource group and assigns it to the Virtual Machine Scale Sets (VMSS) automatically. You can use this managed identity or your own managed identity to access the key vault. It's not supported to prevent creation of the identity.
+
 ## Upgrade an existing AKS cluster with Azure Key Vault provider for Secrets Store CSI Driver support
 
 * Upgrade an existing AKS cluster with Azure Key Vault provider for Secrets Store CSI Driver capability using the [`az aks enable-addons`][az-aks-enable-addons] command and enable the `azure-keyvault-secrets-provider` add-on. The add-on creates a user-assigned managed identity you can use to authenticate to your key vault.
@@ -76,6 +79,9 @@ A container using *subPath volume mount* doesn't receive secret updates when it'
     az aks enable-addons --addons azure-keyvault-secrets-provider --name myAKSCluster --resource-group myResourceGroup
     ```
 
+> [!NOTE]
+> After you enable this feature, AKS creates a managed `identity named azurekeyvaultsecretsprovider-xxx` in the node resource group and assigns it to the Virtual Machine Scale Sets (VMSS) automatically. You can use this managed identity or your own managed identity to access the key vault. It's not supported to prevent creation of the identity.
+
 ## Verify the Azure Key Vault provider for Secrets Store CSI Driver installation
 
 1. Verify the installation is finished using the `kubectl get pods` command, which lists all pods with the `secrets-store-csi-driver` and `secrets-store-provider-azure` labels in the kube-system namespace.