Merge pull request #228782 from schaffererin/akv-aks-secrets

Incorporating feedback

Author: prmerger-automator[bot]

articles/aks/csi-secrets-store-identity-access.md

@@ -4,7 +4,7 @@ description: Learn about the various methods that you can use to allow the Azure
 author: nickomang 
 ms.author: nickoman
 ms.topic: article
-ms.date: 01/31/2023
+ms.date: 02/27/2023
 ms.custom: devx-track-azurecli
 ---
 
@@ -42,7 +42,7 @@ Azure AD workload identity (preview) is supported on both Windows and Linux clus
     az account set --subscription $subscriptionID
     az identity create --name $UAMI --resource-group $resourceGroupName
     export USER_ASSIGNED_CLIENT_ID="$(az identity show -g $resourceGroupName --name $UAMI --query 'clientId' -o tsv)"
-    export IDENTITY_TENANT=$(az aks show --name $clusterName --resource-group $resourceGroupName --query aadProfile.tenantId -o tsv)
+    export IDENTITY_TENANT=$(az aks show --name $clusterName --resource-group $resourceGroupName --query identity.tenantId -o tsv)
     ```
 
 2. You need to set an access policy that grants the workload identity permission to access the Key Vault secrets, access keys, and certificates. The rights are assigned using the `az keyvault set-policy` command shown below.
@@ -120,10 +120,13 @@ Azure AD workload identity (preview) is supported on both Windows and Linux clus
     EOF
     ```
 
+    > [!NOTE]
+    > If you use `objectAlias` instead of `objectName`, make sure to update the YAML script.
+
 6. Deploy a sample pod. Notice the service account reference in the pod definition:
 
     ```bash
-    cat <<EOF | kubectl -n $serviceAccountNamespace -f -
+    cat <<EOF | kubectl apply -f -
     # This is a sample pod definition for using SecretProviderClass and the user-assigned identity to access your key vault
     kind: Pod
     apiVersion: v1
@@ -207,6 +210,9 @@ Azure AD workload identity (preview) is supported on both Windows and Linux clus
         tenantId: <tenant-id>                 # The tenant ID of the key vault
     ```
 
+    > [!NOTE]
+    > If you use `objectAlias` instead of `objectName`, make sure to update the YAML script.
+
 1. Apply the `SecretProviderClass` to your cluster:
 
     ```bash