<p>Trying to export vault secrets as an environment variable to k8s pod using vault injector. Following vault documentation <a href="https://developer.hashicorp.com/vault/docs/platform/k8s/injector/examples#environment-variable-example" rel="nofollow noreferrer">https://developer.hashicorp.com/vault/docs/platform/k8s/injector/examples#environment-variable-example</a></p>
<p>as mention in example, you need to source config file inside a container and it will override ENTRYPOINT script/command that you are passing in dockerfile.</p>
<pre><code>      containers:
        - name: web
          image: alpine:latest
          command:
            ['sh', '-c']
          args:
            ['source /vault/secrets/config &amp;&amp; &lt;entrypoint script&gt;']
</code></pre>
<p>in my setup, I don't have a static entry point script that I can put here in args. docker file has its own command/script running as entrypoint script.</p>
<p>Trying to find if there is any alternative to source this vault config inside a container  that allow me to not change anything in entrypoint script in dockerfile. not sure if k8s is providing any way to do this with post-hook or something. that runs entrypoint mentioned in dockerfile first and then execute other scripts/command passed in post-hook.</p>

<p>You can use the <a href="https://github.com/hashicorp/vault-secrets-operator/" rel="nofollow noreferrer">Vault Secrets Operator</a> to synchronize secrets from Vault to Kubernetes <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secret</a> resources.</p>
<p>Once you've done that, you can then expose those secrets as environment variables using <code>envFrom</code> or <code>vaultFrom</code> directives in your deployment manifests, as described <a href="https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/" rel="nofollow noreferrer">in the documentation</a>.</p>
<p>This method does not require overriding the entrypoint or arguments of your containers.</p>
<hr />
<p>It looks like Vault Secrets Operator is relatively new and the documentation seems a bit slim. You can achieve similar functionality using the <a href="https://external-secrets.io/" rel="nofollow noreferrer">External Secrets Operator</a>, which has the added advantage that it supports a variety of secret store backends.</p>
