Secret object is created with a volume mountpoint only

[flashpixx]

Hello,
I have create a certificate in my Azure KeyVault and would like to create a K8 "kubernetes.io/tls" secret object.
So my structure is:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
   name: mycert
   namespace: gitlab
spec:
   provider: azure
   parameters:
      usePodIdentity: "false"
      useVMManagedIdentity: "true"
      keyvaultName: "myvault"
      tenantId: "mytenantid"
      userAssignedIdentityID: "myuserid"
      objects:  |
         array:
            - |
               objectName: mycert
               objectType: secret
               objectVersion:
   secretObjects:
      - secretName: mycert
         type: "kubernetes.io/tls"
         data:
            - objectName: mycert
              key: tls.key
            - objectName: mycert
              key: tls.crt

It seems this works, but only if I set a mount point, so have got this example code:

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx
  namespace: gitlab
data:
  default.conf: |
    server {
      listen       8080;
      server_name  localhost;

      location / {
          root   /usr/share/nginx/html;
          index  index.html index.htm;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aks-helloworld
  namespace: gitlab
spec:
  replicas: 1
  selector:
    matchLabels:
      app: aks-helloworld
  template:
    metadata:
      labels:
        app: aks-helloworld
    spec:
      containers:
      - name: aks-helloworld
        image: nginx:1-alpine
        ports:
          - name: aks-helloworld
            containerPort: 8080
            protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 32Mi
          requests:
            cpu: 100m
            memory: 32Mi
        volumeMounts:
          - name: aks-helloworld
            mountPath: "/mnt/secrets-store"
            readOnly: true
          - name: config
            mountPath: /etc/nginx/conf.d
      volumes:
        - name: aks-helloworld
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: mycert
        - name: config
          configMap:
            name: nginx
---
apiVersion: v1
kind: Service
metadata:
  name: aks-helloworld
  namespace: gitlab
spec:
  type: ClusterIP
  selector:
    app: aks-helloworld
  ports:
    - name: aks-helloworld
      port: 8080
      targetPort: 8080
      protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
 name: aks-helloworld
 namespace: gitlab
 annotations:
   nginx.ingress.kubernetes.io/rewrite-target: /$1
   kubernetes.io/ingress.allow-http: "false"
spec:
 ingressClassName: nginx
 tls:
   - secretName: mycert
     hosts:
       - my.domain.com
 rules:
   - host: my.domain.com
     http:
       paths:
         - path: /
           pathType: Prefix
           backend:
             service:
               name: aks-helloworld
               port:
                 number: 8080

If I change now my deployment to:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: aks-helloworld
  namespace: gitlab
spec:
  replicas: 1
  selector:
    matchLabels:
      app: aks-helloworld
  template:
    metadata:
      labels:
        app: aks-helloworld
    spec:
      containers:
      - name: aks-helloworld
        image: nginx:1-alpine
        ports:
          - name: aks-helloworld
            containerPort: 8080
            protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 32Mi
          requests:
            cpu: 100m
            memory: 32Mi
        volumeMounts:
          - name: config
            mountPath: /etc/nginx/conf.d
      volumes:
        - name: config
          configMap:
            name: nginx

The certificate object "mycert" does not exists anymore. Is it possible that the certificate sync object, the "kubernetes.io/tls" is generated everytime automatically, without an explicit volume?