<p>I am tasked with integrating ouath2 proxy into an existing kubernetes deployment in order to secure the application's endpoints. We are using Azure as the IDP and HC Vault sidecar to inject secrets into the pod. The existing app is one container, and the oauth2 will be another container, in same pod.  The Vault secrets are meant to be injected as environment variables, using annotations.--The annotations configuration works fine.</p>
<p>I am not sure how to wire the Vault secretes into the oauth2 container, since the oauth2 container already has runtime args it needs.</p>
<p>How can I both source the secrets from the HC Vault and pass my runtime args to the container? It seems like I can do one thing or the other with 'args:' , but not both. Here is how I can do one or the other. How can I do both?</p>
<pre><code>- name: oauth2-proxy
  image: &lt;image&gt;
  # args to source the environment variables from vault secret/sidecar injection
  args: [&quot;/bin/sh&quot;, &quot;-c&quot;, &quot;source /vault/secrets/app &amp;&amp; &lt;entrypoint script&gt;&quot;]

  # args to pass the oauth2 runtime parameters
  args:
  - --provider=azure
  - --email-domain=mydomain.com
  - --http-address=0.0.0.0:4180
  - --azure-tenant=123456789
</code></pre>

<p>ideally, you should be using the vault-injector to add or inject the variables into to POD</p>
<p><a href="https://learn.hashicorp.com/tutorials/vault/kubernetes-sidecar" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/vault/kubernetes-sidecar</a></p>
<p>simple helm command : <code>helm install vault hashicorp/vault --namespace vault --set &quot;injector.externalVaultAddr=&lt;vault address&gt;&quot;</code></p>
<p>Get Token and cluster details :</p>
<pre><code>VAULT_HELM_SECRET_NAME=$(kubectl get secrets -n vault --output=json | jq -r '.items[].metadata | select(.name|startswith(&quot;vault-token-&quot;)).name')

TOKEN_REVIEW_JWT=$(kubectl get secret $VAULT_HELM_SECRET_NAME -n vault  --output='go-template={{ .data.token }}' | base64 --decode)

KUBE_HOST=$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.server}')

KUBE_CA_CERT=$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.certificate-authority-data}' | base64 --decode)
</code></pre>
<p>adding details into the vault of authenticating method</p>
<pre><code>vault write auth/&lt;auth-method-name&gt;/config \
        token_reviewer_jwt=&quot;$TOKEN_REVIEW_JWT&quot; \
        kubernetes_host=&quot;$KUBE_HOST&quot; \
        kubernetes_ca_cert=&quot;$KUBE_CA_CERT&quot;
</code></pre>
<p>You should be using the annotation to fetch the variables from vault</p>
<pre><code>annotations:
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/auth-path: auth/&lt;auth-method-name&gt;
        vault.hashicorp.com/agent-inject-secret-secrets: &quot;kv/&lt;path-of-secret&gt;&quot; 
        vault.hashicorp.com/role: 'app'
        vault.hashicorp.com/agent-inject-template-secrets: |
          {{- with secret &quot;kv/&lt;path-of-secret&gt;&quot; -}}
          #!/bin/sh
          set -e
          {{- range $key, $value := .Data.data }}
          export {{ $key }}={{ $value }}
          {{- end }}
          
          exec &quot;$@&quot;
          {{- end }}
</code></pre>
<p>you can create one shell script into your app, which will check if secret exists or not, if exist shell script will inject data to environment</p>
<p><strong>run.sh</strong></p>
<pre><code>#!/bin/bash
if [ -f '/vault/secrets/secrets' ]; then
  source '/vault/secrets/secrets'
fi
node dist/server.js
</code></pre>
<p>Your docker will be running your shell script file so you don't need to pass arg now, yes in this method you have to change existing docker.</p>
<p>Refrence : <a href="https://learn.hashicorp.com/tutorials/vault/kubernetes-sidecar#pod-with-annotations" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/vault/kubernetes-sidecar#pod-with-annotations</a></p>
