Add projected service account support

[tvoran]

Continues #79. Fixes #78.

Adds more unit tests for serviceaccount(), and reads the tokenPath from the volumeMount for projected tokens.

Description

This PR adds the ability to specify a projected service token for vault-agent to use with auto-auth against the vault kubernetes auth method.

It adds a new annotation, vault.hashicorp.com/agent-service-account-token-volume-name, which is the name of the projected volume holding the token. If the volume is mounted to another container in the deployment, the token volume will be mounted to the same location in the vault-agent containers. Otherwise it will be mounted at the default location of /var/run/secrets/vault.hashicorp.com/serviceaccount/.

Example

Take the example nginx Pod from here, and add these annotations:

  annotations:
    # AGENT INJECTOR SETTINGS
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/agent-inject-status: "update"
    vault.hashicorp.com/agent-inject-secret-kv-secret: "internal/nginx"
    vault.hashicorp.com/agent-inject-template-kv-secret: |
      {{ with secret "internal/nginx" }}{{ .Data | toJSONPretty }}{{ end }}
    # VAULT SETTINGS
    vault.hashicorp.com/role: "app"
    vault.hashicorp.com/agent-service-account-token-volume-name: "vault-token"

Configure vault to accept the token with a role something like this:

vault write auth/kubernetes/role/app \
      bound_service_account_names=build-robot \
      bound_service_account_namespaces=default \
      audience=vault \
      policies=internal-app \
      ttl=24h

Once the Pod is deployed, vault-agent will be configured to use the token /var/run/secrets/tokens/vault-token for auto-auth. That token is periodically refreshed by kubernetes, and vault-agent will read the new token and use it whenever its refreshed.

One nice thing about this setup is that since the vault role is configured to only allow tokens that have an audience of vault, only the projected token will work, since the normal service token will have an audience of something like https://kubernetes.default.svc.cluster.local.

And in this example, to mount the projected token only on the vault-agent containers, remove the volumeMounts block from the nginx container. Then vault-agent will be configured to use the token at /var/run/secrets/vault.hashicorp.com/serviceaccount/vault-token for auto-auth.

[benashz]

LGTM!