<p>I'm using Hashicorp Vault in Kubernetes. I'm trying to mount secret file into main folder where my application resides. It would look like that: <code>/usr/share/nginx/html/.env</code> while application files are in <code>/usr/share/nginx/html</code>. But the container is not starting because of that. I suspect that that <code>/usr/share/nginx/html</code> was overwritten by Vault (annotation: <code>vault.hashicorp.com/secret-volume-path</code>). How can I mount only file <code>/usr/share/nginx/html/.env</code>?</p>
<p>My annotations:</p>
<pre><code>vault.hashicorp.com/agent-init-first: &quot;true&quot;
vault.hashicorp.com/agent-inject: &quot;true&quot;
vault.hashicorp.com/agent-inject-secret-.env: configs/data/app/dev
vault.hashicorp.com/agent-inject-template-.env: |
  {{- with secret (print &quot;configs/data/app/dev&quot;) -}}{{- range $k, $v := .Data.data -}}
  {{ $k }}={{ $v }}
  {{ end }}{{- end -}}
vault.hashicorp.com/role: app
vault.hashicorp.com/secret-volume-path: /usr/share/nginx/html
</code></pre>

<p>I tried to replicate the use case, but I got an error</p>
<pre><code>2022/10/21 06:42:12 [error] 29#29: *9 directory index of &quot;/usr/share/nginx/html/&quot; is forbidden, client: 20.1.48.169, server: localhost, request: &quot;GET / HTTP/1.1&quot;, host: &quot;20.1.55.62:80&quot;
</code></pre>
<p>so it seems like vault changed the directory permission as well, as it create <code>.env</code> in the path, here is the config</p>
<pre><code>        vault.hashicorp.com/agent-init-first: &quot;true&quot;
        vault.hashicorp.com/agent-inject: &quot;true&quot;
        vault.hashicorp.com/agent-inject-secret-.env: kv/develop/us-west-2/app1-secrets
        vault.hashicorp.com/agent-inject-template-.env: |
          &quot;{{ with secret &quot;kv/develop/us-west-2/app1-secrets&quot; }}
          {{ range $k, $v := .Data.data }}
           {{ $k }} = &quot;{{ $v }}&quot;
          {{ end }}
          {{ end }} &quot;
        vault.hashicorp.com/agent-limits-ephemeral: &quot;&quot;
        vault.hashicorp.com/secret-volume-path: /usr/share/nginx/html/
        vault.hashicorp.com/agent-inject-file-.env: .env
        vault.hashicorp.com/auth-path: auth/kubernetes/develop/us-west-2
        vault.hashicorp.com/role: rolename
</code></pre>
<p>The work around was to overide the <code>command</code> of the desired container, for this use case, i used <code>nginx</code></p>
<pre><code>command: [&quot;bash&quot;, &quot;-c&quot;, &quot;cat /vault/secret/.env &gt; /usr/share/nginx/html/.env &amp;&amp; nginx -g 'daemon off;' &quot;]
</code></pre>
<p>Here is the compelete example with dummy value of <code>my-app</code></p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: debug-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
      annotations:
        vault.hashicorp.com/agent-init-first: &quot;true&quot;
        vault.hashicorp.com/agent-inject: &quot;true&quot;
        vault.hashicorp.com/agent-inject-secret-.env: kv/my-app/develop/us-west-2/develop-my-app
        vault.hashicorp.com/agent-inject-template-.env: |
          &quot;{{ with secret &quot;kv/my-app/develop/us-west-2/develop-my-app&quot; }}
          {{ range $k, $v := .Data.data }}
           {{ $k }} = &quot;{{ $v }}&quot;
          {{ end }}
          {{ end }} &quot;
        vault.hashicorp.com/agent-limits-ephemeral: &quot;&quot;
        vault.hashicorp.com/secret-volume-path: /vault/secret/
        vault.hashicorp.com/agent-inject-file-.env: .env
        vault.hashicorp.com/auth-path: auth/kubernetes/develop/us-west-2
        vault.hashicorp.com/role: my-app-develop-my-app
    spec:
      serviceAccountName: develop-my-app
      containers:
        - name: debug
          image: nginx
          command: [&quot;bash&quot;, &quot;-c&quot;, &quot;cat /vault/secret/.env &gt; /usr/share/nginx/html/.env &amp;&amp; nginx -g 'daemon off;' &quot;]
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http
</code></pre>
