如何直接从HashiCorp Vault获取TLS密钥用于Kubernetes Ingress？

我在基于OpenStack的Kubernetes环境中部署了微服务，采用Nginx Ingress与HashiCorp Vault，TLS证书密钥存储于HashiCorp Vault内。我已创建如下SecretProviderClass：

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: sslspc
spec:
  provider: vault
  secretObjects:
  - secretName: sslspc
    data:
    - key: "tls.key"
      objectName: TLSKey
    - key: "tls.crt"
      objectName: TLSCert
    type: kubernetes.io/tls
  parameters:
    vaultAddress: http://vault.vault:8200
    roleName: "approle"
    objects:  |
      - objectName: TLSKey
        secretPath: "secret/data/myssl"
        secretKey: "tls.key"
      - objectName: TLSCert
        secretPath: "secret/data/myssl"
        secretKey: "tls.crt"

但无法直接将其用于Ingress，必须创建一个额外Pod来挂载卷并映射环境变量：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: depssl
  labels:
    app: appbusy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: appbusy
  template:
    metadata:
      labels:
        app: appbusy
    spec:
      serviceAccountName: mysa
      containers:
      - name: appbusy
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["/bin/sh"]
        args: ["-c", "while true; do sleep 300;done"]
        env:
        - name: TLS.KEY
          valueFrom:
            secretKeyRef:
              name: sslspc
              key: tls.key
        - name: TLS.CRT
          valueFrom:
            secretKeyRef:
              name: sslspc
              key: tls.crt
        volumeMounts:
        - name: sslspc
          mountPath: "/mnt/secrets-store"
          readOnly: true
      volumes:
      - name: sslspc
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "sslspc"

完成上述操作后，才能在Ingress中使用该密钥：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    secretName: sslspc
  rules:
  - host: example.com
    http:
      paths:
        - pathType: Prefix
          path: /
          backend:
            service:
              name: myservice
              port:
                number: 80

请问是否可以无需创建这类仅用于映射的额外Pod，直接在Ingress中从HashiCorp Vault获取TLS密钥？

更新（2023年3月）：
经研究，目前无法实现该需求。使用Sidecar等方案会增加复杂度与资源消耗，最终我采用上述简单的busybox Deployment来生成密钥，这是最简单且资源消耗最低的方案。

内容的提问来源于stack exchange，提问作者ibram