put secret generated from annotations template to existing path / like consul destination directive

[ch0mik]

ex :

  annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-status: "update"
        vault.hashicorp.com/agent-run-as-same-user: "true"
        vault.hashicorp.com/secret-volume-path: "/app/"  
        vault.hashicorp.com/agent-inject-secret-globalsettings.json: "kv/global"
        vault.hashicorp.com/agent-inject-template-globalsettings.json: |
          {{- with secret "kv/global" -}}
          {
            "Redis": {
                    "Host": "redis.local",
                    "Port": 8803,
                    "Name": "1",
                    "DatabaseNo": 2,
                    "Password": "{{ .Data.data.redis_password }}",
                    "SlidingExpirationInMinutes": 60
            }
          }
          {{- end }}
        vault.hashicorp.com/role: "myapp"

    vault.hashicorp.com/secret-volume-path: "/app/"   - app .net core, not working when its == "/app/"
   rights to the generated file (in another directory ex. /vault/secrets/) are ok

Is it possible to map this generated file from secrets to filepath like consul templates ?

destination = "/app/globalsettings.json"

ex.
vault.hashicorp.com/agent-inject-destination-globalsettings2.json: "/app/globalsettings.json"

Regards
Pawel

[ch0mik]

when change this (another path)
vault.hashicorp.com/secret-volume-path: "/vault/secrets/"

the copy command
vault.hashicorp.com/agent-inject-command-globalsettings2.json: "/bin/sh -c 'cp /vault/secrets/globalsettings2.json /tmp/'"

also not working
PS. #56

[tvoran]

The inject-command is copying the settings file to /tmp/ on the vault-agent containers, not the app container, so I think that's why it's not working.

If you can't specify an alternate location for the settings file, perhaps you can run the cp command in the app container, or create a symlink from /vault/secrets/globalsettings2.json to /app/globalsettings2.json in the app container.

[ch0mik]

The inject-command is copying the settings file to /tmp/ on the vault-agent containers, not the app container, so I think that's why it's not working.

for tests i choose the /tmp/ folder - after run the container, the command not runs. If I myself run the command its put to the /tmp/ or /app/ works.
cp /vault/secrets/globalsettings2.json /app

[ch0mik]

workaround for .net core app is seeking the another path to gets the .json files

            return new ConfigurationBuilder()
                .SetBasePath(path)
                .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
                .AddJsonFile("globalsettings.json", true, true)
		.AddJsonFile("/secrets/appsettings.json", optional: true, reloadOnChange: true)
		.AddJsonFile("/secrets/globalsettings.json", true, true)
                .AddEnvironmentVariables()
                .Build();

[stewartshea]

I too could use a feature like this, or even the ability to create subdirectories under the /vault/secrets shared path. Grafana has a need to access configuration files under a couple of different directories, which would possibly work with something like this layout;

• /vault/secrets/provisioning/datastources/<keys>
• /vault/secrets/provisioning/dashboards/<keys>

Currently it won't work by mixing the contents of those secrets in a single folder like vault/secrets/

[stewartshea]

As a workaround, I was able to use the command feature like this:

        vault.hashicorp.com/agent-inject-command-datasource.yaml: /bin/sh -c 'mkdir
          -p /vault/secrets/provisioning/datasources && ln -s /vault/secrets/datasource.yaml
          /vault/secrets/provisioning/datasources/datasource.yaml'

It's not elegant but it should work for now.

[tvoran]

@stewartshea You may be able to make use of the secret-volume-path annotation: https://www.vaultproject.io/docs/platform/k8s/injector/annotations#vault-hashicorp-com-secret-volume-path

Otherwise the upcoming release of vault-k8s will add an agent-inject-file annotation which will allow for arbitrary directory structures in the secrets volume: #158

[stewartshea]

In my case I still needed to create arbitrary directory structures to support the way grafana is configured, but it looks like #158 may solve this for me.