K8s , Vault Agent Injector .. agent-inject-file-SECRET: /custom/path/secret not working as expected

cleanshavenalex · August 10, 2020, 7:39pm

There is an agent-inject-file-$SECRET_NAME: $CUSTOM_PATH but I feel the implementation does not match the expectation of the override.

github.com

hashicorp/vault-k8s/blob/master/agent-inject/agent/annotations.go#L378


			mountPathAnnotationName := fmt.Sprintf("%s-%s", AnnotationVaultSecretVolumePath, raw)
			if val, ok := a.Annotations[mountPathAnnotationName]; ok {
				s.MountPath = val
			}

			commandName := fmt.Sprintf("%s-%s", AnnotationAgentInjectCommand, raw)
			if val, ok := a.Annotations[commandName]; ok {
				s.Command = val
			}

			file := fmt.Sprintf("%s-%s", AnnotationAgentInjectFile, raw)
			if val, ok := a.Annotations[file]; ok {
				s.FilePathAndName = val
			}

			secrets = append(secrets, s)
		}
	}
	return secrets
}

If I understand this correctly inject-file annotation will let you define a custom subpath but the filename will still be the secret name.
Also it is unclear if there is any additional configuration/code needed to make sure that the agent container can or will create/write to subdirectories of /vault/secrets “/vault/secrets/custom/path/custom-file-name”
Our intention of trying to use the inject file annotation is to mirror the Vault path of the secret in the path used by the agent - “/vault/secrets////”