Incorporated SME review comments

Author: Dhruv-Soni11

_topic_maps/_topic_map.yml

@@ -115,7 +115,7 @@ Topics:
   File: securing-webhooks-with-event-listeners
 - Name: Authenticating pipelines with repositories using secrets
   File: authenticating-pipelines-repos-using-secrets
-- Name: Using secrets from dedicated stores
+- Name: Using secrets from external secret stores
   File: using-secret-stores
 - Name: Unprivileged building of container images using Buildah
   File: unprivileged-building-of-container-images-using-buildah

modules/op-csi-secrets.adoc

@@ -3,10 +3,10 @@
 // * secure/using-csi-secrets.adoc
 
 :_mod-docs-content-type: PROCEDURE
-[id="configuring-results_{context}"]
+[id="consuming-secrets-csi_{context}"]
 = Consuming secrets from an external store such as Hashicorp Vault using the Secrets Store CSI Driver
 
-If you want to use secrets from an external store that has a CSI (container storage interface) provider, for example, Hashicorp Vault, you can configure {pipelines-shortname} to consume these secrets using the Secrets Store CSI Driver.
+If you want to use secrets from an external store that has a Container Storage Interface (CSI) provider, for example, Hashicorp Vault, you can configure {pipelines-shortname} to consume these secrets using the Secrets Store CSI Driver.
 
 .Prerequisites
 
@@ -16,7 +16,7 @@ If you want to use secrets from an external store that has a CSI (container stor
 +
 [NOTE]
 ====
-If you want to use an instance of Hashicorp Vault running outside your {OCP} cluster, you must provide the address to that instance in the Helm configuration when installing the CSI Provider. For infoamtion about providing an external Vault address, see link:https://developer.hashicorp.com/vault/docs/deploy/kubernetes/helm/configuration#externalvaultaddr[Configuration] in the Hashicorp documentation.
+If you want to use an instance of Hashicorp Vault running outside your {OCP} cluster, you must provide the address to that instance in the Helm configuration when installing the CSI Provider. For information about providing an external Vault address, see link:https://developer.hashicorp.com/vault/docs/deploy/kubernetes/helm/configuration#externalvaultaddr[Configuration] in the Hashicorp documentation.
 ====
 
 * You configured authentication with the secret store for an {OCP} service account, for example, `pipeline-sa`. For information about configuring Kubernetes authentication with Hashicorp Vault, see link:https://developer.hashicorp.com/vault/docs/auth/kubernetes[Kubernetes auth method] in the Hashicorp documentation.
@@ -88,6 +88,11 @@ spec:
         secretPath: "secret/data/my-secret"
         secretKey: "password"
 ----
++
+[WARNING]
+====
+The `vaultAddress` parameter used in this example uses `http` and `vaultSkipTLSVerify`: `"true"` only for demonstration purposes. For production use, configure Vault with a secure `https` endpoint and do not skip TLS verification.
+====
 
 . In the definition of the task that consumes the secrets, define and mount a volume that uses the CSI secrets store driver and specifies the name of the `SecretProviderClass` CR. To minimise security exposure of secrets, mount them in the definition of a task and not of an entire pipeline.
 +
@@ -134,6 +139,18 @@ The mount path that you specify in the pipeline or task definition overrides the
 [source,yaml]
 ----
 apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: vault-secret-pipeline
+  namespace: tekton-vault
+spec:
+  tasks:
+    - name: read-secret
+      taskRef:
+        name: secret-task
+      serviceAccountName: pipeline-sa
+---
+apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: vault-secret-pipeline-run
@@ -151,11 +168,13 @@ spec:
 .Example `TaskRun` CR
 [source,yaml]
 ----
+apiVersion: tekton.dev/v1
 kind: TaskRun
 metadata:
   name: vault-secret-task-run
+  namespace: tekton-vault
 spec:
   taskRef:
-    name: secretTask
+    name: secret-task
   serviceAccountName: pipeline-sa
 ----

secure/using-secret-stores.adoc

@@ -6,6 +6,6 @@ include::_attributes/common-attributes.adoc[]
 
 toc::[]
 
-Your pipelines can use secrets that are kept in an dedicated store.
+You can configure pipelines to consume secrets from external secret stores by using the Secrets Store CSI driver.
 
 include::modules/op-csi-secrets.adoc[leveloffset=+1]