<p>I don't understand how to apply hashicorp vault to inject secrets in my app.</p>
<p>The following link shows a couple of examples <a href="https://www.vaultproject.io/docs/platform/k8s/injector/examples" rel="nofollow noreferrer">https://www.vaultproject.io/docs/platform/k8s/injector/examples</a></p>
<p>I used the <a href="https://www.vaultproject.io/docs/platform/k8s/injector/examples#environment-variable-example" rel="nofollow noreferrer">environment variables example</a> from the same post. But it seems not all the env variables are injected into the app. For instance, ENVs in one of my layouts don't seem to get applied <code>meta property=&quot;og:title&quot; content=&quot;#{ENV['NAME']}&quot;</code> - shows no value. But the app is running, /vault/secrets/... has files with contents.</p>
<p>Here's a part of the Deployment config of my app.</p>
<p>When there're multiple secrets/templates, the Deployment is going to look ugly.</p>
<p>There's absolutely no description for <a href="https://www.vaultproject.io/docs/platform/k8s/injector/examples#configmap-example" rel="nofollow noreferrer">configmap example</a> but this is probably what I should be using instead of env.</p>
<pre><code>...
     annotations:
        vault.hashicorp.com/agent-inject: &quot;true&quot;
        vault.hashicorp.com/role: &quot;app-role&quot;
        vault.hashicorp.com/agent-inject-status: &quot;update&quot;
        vault.hashicorp.com/agent-inject-secret-pg.env: &quot;secret/data/pg&quot;
        vault.hashicorp.com/agent-inject-template-pg.env: |
          {{` {{- with secret &quot;secret/data/pg&quot; -}} `}}
          {{` export POSTGRES_HOST={{ .Data.data.host }} `}}
          {{` export POSTGRES_PORT={{ .Data.data.port }} `}}
          {{` export POSTGRES_USER={{ .Data.data.user }} `}}
          {{` export POSTGRES_PASSWORD={{ .Data.data.password }} `}}
          {{` {{- end }} `}}
        vault.hashicorp.com/agent-inject-secret-meta.env: &quot;secret/data/app/meta&quot;
        vault.hashicorp.com/agent-inject-template-meta.env: |
          {{` {{- with secret &quot;secret/data/app/meta&quot; -}} `}}
          {{` export BASE_URL={{ .Data.data.url }} `}}
          {{` export DESCRIPTION={{ .Data.data.description }} `}}
          {{` export IMAGE={{ .Data.data.image }} `}}
          {{` export NAME={{ .Data.data.name }} `}}
          {{` {{- end }} `}}

    spec:
      serviceAccountName: app  

...
args: [&quot;/bin/bash&quot;, &quot;-c&quot;, &quot;source /vault/secrets/*.env &amp;&amp; bundle exec puma -C config/puma.rb&quot;]
</code></pre>

<p>If you want to inject the vault secret into the deployment pod what you can do</p>
<p>There is one great project on Github Vault-CRD in java: <a href="https://github.com/DaspawnW/vault-crd" rel="nofollow noreferrer">https://github.com/DaspawnW/vault-crd</a></p>
<p>Vault CRD for sharing Vault Secrets with Kubernetes. It injects &amp; sync values from Vault to Kubernetes secret. You can use these secrets as environment variables inside pod.</p>
<p>the flow goes something like : <code>vault to Kubernetes secret &gt; and that secrets get injected into deployment using YAML same as configmap</code></p>
<p>apart from this there is also another nice method of sidecar pattern.</p>
<p>for that, there is a very nice tutorial: <a href="https://github.com/hashicorp/hands-on-with-vault-on-kubernetes" rel="nofollow noreferrer">https://github.com/hashicorp/hands-on-with-vault-on-kubernetes</a></p>
<p>another one : <a href="https://www.hashicorp.com/blog/injecting-vault-secrets-into-kubernetes-pods-via-a-sidecar" rel="nofollow noreferrer">https://www.hashicorp.com/blog/injecting-vault-secrets-into-kubernetes-pods-via-a-sidecar</a></p>
