<p>I am using the <code>OAuth2-Proxy</code> helm chart which is authenticating using an external oidc provider, along with Vault to store the secrets. Now, in order to pass it the <code>client-id</code> &amp; <code>client-secret</code> secrets stored in Vault, I followed this link - <a href="https://www.vaultproject.io/docs/platform/k8s/injector/examples#environment-variable-example" rel="nofollow noreferrer">https://www.vaultproject.io/docs/platform/k8s/injector/examples#environment-variable-example</a></p>
<p>This shows how to add these secrets as env vars in a container, but <code>OAuth2-Proxy</code> needs these variables to start in the first place (They are passed as args to the docker image's entrypoint). I also tried adding the source command to the <code>postStart</code> lifecycle method but that also gives the following error -</p>
<pre><code>Exec lifecycle hook ([sh -c source /vault/secrets/oidc.sh]) for Container &quot;oauth2-proxy&quot; in Pod &quot;oauth2-proxy-f6c8f7b69-kgjws_istio-system(7e488c12-2964-496f-a658-47739fcf3695)&quot; failed - error: command 'sh -c source /vault/secrets/oidc.sh' exited with 126: , message: &quot;OCI runtime exec failed: exec failed: cannot exec a container that has stopped: unknown\r\n&quot;
</code></pre>
<p>I think this is because the docker image's entry-point requires those env vars and the container dies off as soon as that command fails. Is there any other approach for doing this?</p>

Hemabh
<p>Here is a way to inject vault secrets into the k8s pod as ENV vars using <strong>vault Agent Injector</strong> method</p>
<p>First A template should be created that exports a Vault secret as an environment variable.</p>
<pre><code>spec:   template:
    metadata:
      annotations:
        # Environment variable export template
        vault.hashicorp.com/agent-inject-template-config: |
          {{ with secret &quot;secret/data/web&quot; -}}
            export api_key=&quot;{{ .Data.data.payments_api_key }}&quot;
          {{- end }}
</code></pre>
<p>And the application container should source those files during startup.</p>
<pre><code>args:
  ['sh', '-c', 'source /vault/secrets/config &amp;&amp; &lt;entrypoint script&gt;']
</code></pre>
