Recommended way to inject secrets into pod from multiple path with annotations?

Vault
1

Hello All,
Currently i am using the following way to inject secrets into the pod.

        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "internal-role"
        vault.hashicorp.com/agent-inject-secret-keys1: "internal/data/keys1"
        vault.hashicorp.com/log-level: "debug"
        vault.hashicorp.com/agent-inject-template-keys1: |
          {{- with secret "internal/data/keys1" -}}
          export USERNAME_DEV="{{ .Data.data.user }}"
          {{- end -}}
        vault.hashicorp.com/agent-inject-secret-keys2: "internal/data/keys2"
        vault.hashicorp.com/agent-inject-template-keys2: |
          {{- with secret "internal/data/keys2" -}}
          export PASSWORD="{{ .Data.data.password }}"
          {{- end -}}

I am sourcing the above as env variables in the pod.

command: ["/bin/sh", "-ec"]
 args: [
              "for f in `ls -a /vault/secrets/keys*`; do source $f; done; env > /tmp/env.txt; sleep 1000000",
            ]

My question is there a way the above method could be improved or some others ways, where i want multiple secret paths to be injected. Thanks

2

Check out consul-templates.

3

Not sure i can use consul templates as the setup is HA mode with raft.

4

You can. Consul-template has out grown it’s name. Think of it as a templating-language that has logic and loops.