search

hashicorp / vault-k8s

First-class support for Vault and Kubernetes.
Mozilla Public License 2.0
786 stars 169 forks source link

Support vault secret inject while the main pod "automountServiceAccountToken" set false #601

Open TommyLike opened 7 months ago

TommyLike commented 7 months ago

Is your feature request related to a problem? Please describe. vault injector works well, but for our security concern, is it possible to inject secret to our deployment pod while the "automountServiceAccountToken" setting false?

Describe the solution you'd like see above

Describe alternatives you've considered Nope

Additional context To eliminate the security concern from our security team who worried that we don't need mount the service account when the main pod does not need to.

TommyLike commented 7 months ago

Ok, I found the solution myself, steps to disable auto mount the service account in business pod while used by init container

  1. define the prioject volume which use the service account in deployment
  2. add automountServiceAccountToken=false in deployment
  3. add the annotation "vault.hashicorp.com/agent-service-account-token-volume-name: ----the project volume name----"

This configure will make deployment work as expected