Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

k8s: Injecting env variable from app dc to custom vault-agent Init/ Vault-agent sidecar image #161

Open
shuvankar0907 opened this issue Jul 28, 2020 · 1 comment · May be fixed by #305
Open

k8s: Injecting env variable from app dc to custom vault-agent Init/ Vault-agent sidecar image #161

shuvankar0907 opened this issue Jul 28, 2020 · 1 comment · May be fixed by #305
Labels
enhancement New feature or request

Comments

@shuvankar0907
Copy link

Is your feature request related to a problem? Please describe.
We have custom solution to read secrets from vault and provide it for the apps to use. I wanted to replace the image provided by vault that is used as init/sidecar container and use our own image. Our custom image requires few env variable to work.
Provide a way to pass env variables from mentioned application dc (annotations) to init/sidecar container env variable.

Describe the solution you'd like
extraEnvironmentVars option that is provided in application DC, make it available to init/sidecar as environment variable. I can then this option to inject my required variables to sidecar/init images.

If this change is provided I will be able to use vault agent in our organisation.
@shuvankar0907 shuvankar0907 added the enhancement New feature or request label Jul 28, 2020
@freimer
Copy link

freimer commented Oct 31, 2021

I'm not sure what you exactly mean, but instead of creating another issue I'll tag onto this because I think it may be the same. We'd like the init/sidecar to mirror the container env vars when mutating the request. I think it can probably be handled here:
https://github.com/hashicorp/vault-k8s/blob/main/agent-inject/agent/container_env.go

So, for example, if the original request was to run some container in a pod and that container had env vars VAR1 set to VALUE1 and VAR2 set to VALUE2 then the vault-agent-init and vault-agent containers that are injected would have these variables in addition to the ones it adds for Vault.

The use-case in very specific terms, is that we have airflow spinning up pods for dags, and it sets an ENV VAR for what the name of the DAG is when it spins up. We'd like to use this env var in the Vault Agent templates to pull different secrets based on the name of the DAG. Vault Agent can't read pod labels or annotations, but we can configure the template that airflow uses to set an ENV VAR to mirror the labels. If the Agent Injector copied the pod ENV VARs to the vault-agent and vault-agent-init containers then we could do this.

@freimer freimer linked a pull request Oct 31, 2021 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Mirror pod container env vars on sidecars, unless duplicates freimer/vault-k8s
2 participants
@freimer @shuvankar0907