Open ArkeologeN opened 4 years ago
I found this comment helpful to solve the problem for KV V2 storage at least. TL;DR - to list secrets in a KV path, use kv/svcDeploy/config/project/metadata
instead of kv/svcDeploy/config/project/
(note metadata
in the end).
There is no bug here. You must do two things for wildcards to functionwith the KV2 engine:
agent-inject-secret
annotation in addition to using your wildcard in the template. metadata
path with wildcard in the range
expression of your templateHere's an example:
vault.hashicorp.com/agent-inject-secret-foo: mount/path/to/secrets/*
vault.hashicorp.com/agent-inject-template-foo: |
{{ range secrets "mount/metadata/path/to/secrets/*" }}
{{ with secret (printf "mount/path/to/secrets/%s" .) }}
...
{{ end }}
{{ end }}
Background:
We are running a sidecar container (agent injector) within our Kubernetes application cluster. The template literals work fine for the following case:
And the above solves a partial thought only. Since we have over ~30 secrets at the path:
kv/svcDeploy/config/project
, I want to be able to list them all and mount inside the Pod, rather than declaring a template again and again.NOT PREFERRED:
Following is not the preferred way, altough it could work:
PREFERRED WAY:
As per the documentation (
with secrets.
), it should work, but it does nothing. There is no file created nor there is an error.And here is the actual definition: