🚀 annotations in the operator configuration to pull auth tokens from Vault via `Vault injector`

[sharccc]

Description

Feature Request: requesting the option to configure the operator to pull auth tokens from Vault using an available integration: Vault injector. It would be nice to have the integration with Vault injector out of the box - currently the AgentPool requires the API token to be stored as a Secret, so it's not currently possible to use Vault injector to pull it from Vault. This can be achieved by allowing annotations in the helm chart (using native support, the workload in kubernetes, would then):

• trigger the mutating web hook
• resulting in a vault agent injector container getting added to the pod
• that then reaches out to vault to retrieve stored secrets

Potential YAML Configuration

annotations:
  vault.hashicorp.com/agent-inject: 'true'
  vault.hashicorp.com/agent-inject-secret-operator-token: 'tfe/operator/token'
  ...

References

example (in this case database/creds/db-app) https://developer.hashicorp.com/vault/docs/platform/k8s/injector/examples#deployments-statefulsets-etc

Community Note

• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

[razorsk8jz]

We were able to do something similar, we are using vault to store our token and using vault-secrets-operator to create the secret based on a vault-static-secret. Hopefully this helps https://github.com/hashicorp/vault-secrets-operator

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: tfc-agent-static-secret
spec:
  type: kv-v2

  # mount path
  mount: kv

  # path of the secret
  path: my/path

  # dest k8s secret
  destination:
    name: my-secret-name
    create: true

  # static secret refresh interval
  refreshAfter: 30s

[sharccc]

internal reference 124942 (terraform support)