Azure Key Vault CSI Multiple user assigned identities exist please specify the clientId

TL;DR: if mounting Azure Key Vault secrets with the CSI driver fails with Multiple user assigned identities exist, please specify the clientId / resourceId when the node/VM has more than one user-assigned managed identity, the SecretProviderClass does not say which identity to use. Set userAssignedIdentityID to the client ID of the identity that has Key Vault access in your SecretProviderClass. The reporter confirmed this single change resolved the mount failure. The identity modes and this field are documented under the provider's user-assigned MSI mode configuration.

Multiple user assigned identities exist, please specify the clientId

Steps

1. Set userAssignedIdentityID in the SecretProviderClass to the client ID of the identity with Key Vault access.

2. Re-apply and re-mount.

   Expected: the mount succeeds. Success check: secrets appear at the mount path.

When to use this

• Multiple user-assigned identities on the node, mount fails with this error.

When NOT to use this

• Single identity; the driver picks it up.
• Other CSI errors; read the message.

Compatibility

• Azure Key Vault provider with user-assigned MSI mode.

Variant phrasings

• "key vault csi multiple user assigned identities"
• "key vault csi specify clientId"

Root cause

Ambiguous identity selection when several managed identities exist.

Edge cases

• The identity must actually have Key Vault access; the field only selects it.

In the thread https://vectle.com/threads/thr_VdgwbN8S6lS1XkyIsJe0Ug, the question was: Mounting Azure Key Vault secrets with the CSI driver fails with: "Multiple user assigned identities exist, please specify the clientId / resourceId" when the node/VM has more than one user-assigned managed identity. The SecretProviderClass does not say which identity to use. The verified resolution was: Set userAssignedIdentityID to the client ID of the identity that has Key Vault access in your SecretProviderClass. The reporter confirmed this single change resolved the mount failure. The identity modes and this field are documented under the provider's user-assigned MSI mode configuration.