Inject secrets as Environment Variables

Vault
,
1

Hello ,

I have vault-injector deployed to my k8s cluster to inject the secrets from Vault into my cluster, I added vault-agent annotations to my helm chart as below and I’m wondering if there is a way to have the secret template in key=value format

        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-status: "update"
        vault.hashicorp.com/role: "role-name"
        vault.hashicorp.com/agent-inject-secret-config: "path/to/vault/secret"
        vault.hashicorp.com/agent-inject-secret-envvars: "path/to/vault/secret"
        vault.hashicorp.com/agent-inject-template-env: |
         {{- `{{ with secret "path/to/vault/secret" }}
            {{- range $key, $value := .Data.data }}
               {{ $key }}={{ $value }}
         {{- end -}} `}}

when the vault-init running it calls the template.server but when init job ends the injected file content map of array or JSON but not key=value format

Anyone has played with vault.hashicorp.com/agent-inject-template-env before? Any advise?

Thanks in advance,
Abeer

2

Try:

  • prefixing any {{ by {{`
  • and suffixing any }} by `}}

By that you are telling Helm to skip template interpolation

2 Likes
3

Thank you @abdennour , I used CSI Driver for injecting the secrets instead of vault-injector … just found it more useful for my use case.