Vault Kubernetes Injector: pull specific version of kv v2

Vault
1

It’s unclear from the documentation whether there is a means to configure the pod annotations to request a specific secret version from the kv v2 engine. We want the ability to request specific versions so that if a new version is cut and a secret is incorrect or missing, the pod annotations will be rolled back to reference the last known good version.

Is there any way to achieve this currently with the vault-k8s agent injector?

2

Additional note: we did attempt to append the version as a query parameter to the annotation, e.g. vault.hashicorp.com/agent-inject-secret-foo.txt: foo/bar?version=2

However this did not have the intended effect and the latest version of the secret was still pulled.