The CSI driver uses hostPath to mount ephemeral volumes into the pods, which some container platforms (e.g. OpenShift) disable by default. On the other hand, Sidecar Agent Service uses in-memory tmpfs volumes. Sidecar Injector Service automatically renews, rotates, and fetches secrets/tokens.