<p>I am trying to <code>source</code> a file from <code>/vault/secrets/cloudquery</code> which contains data that looks like this:</p>
<pre><code>export MYSECRET=&quot;REDACTED&quot;
</code></pre>
<p>I have tried a ton of different things to source the vault secrets file when my pod starts up, but when I shell into the pod, I don't see the env variables set. Can anyone point out what I'm doing wrong? Thank you!!</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
  ...
spec:
  ...
  template:
    metadata:
    ...
      annotations:
        vault.hashicorp.com/role: default
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-inject-secret-cloudquery: &quot;path/to/mysecret&quot;
        vault.hashicorp.com/agent-inject-template-cloudquery: |
          {{ with secret &quot;path/to/mysecret&quot; -}}
            export MYSECRET=&quot;{{ .Data.MYSECRET }}&quot;
          {{- end }}
    spec:
      containers:
        - name: cloudquery
          ...
          readinessProbe:
            exec:
              command: [ &quot;/bin/sh&quot;, &quot;-c&quot;, &quot;test -e /vault/secrets/cloudquery&quot; ]
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 5
          lifecycle:
            postStart:
              exec:
                command:
                  - &quot;/bin/sh&quot;
                  - &quot;-c&quot;
                  - &quot;source /vault/secrets/cloudquery&quot;
...
</code></pre>

dobbs
<p>You can do something like this if looking forward to inject the environment with POD startup</p>
<pre><code>annotations:
        vault.hashicorp.com/agent-image: &lt;Agent image&gt;
        vault.hashicorp.com/agent-inject: &quot;true&quot;
        vault.hashicorp.com/agent-inject-secret-secrets: kv/&lt;Path-of-secret&gt;
        vault.hashicorp.com/agent-inject-template-secrets: |2

          {{- with secret &quot;kv/&lt;Path-of-secret&gt;&quot; -}}

          #!/bin/sh
          set -e

          {{- range $key, $value := .Data.data }}
          export {{ $key }}={{ $value }}
          {{- end }}

          exec &quot;$@&quot;
          {{- end }}
        vault.hashicorp.com/auth-path: auth/&lt;K8s cluster for auth&gt;
        vault.hashicorp.com/role: app
</code></pre>
<p>This will create the file inside your POD.</p>
<p>Inside your Docker file if you are simply running an application <code>CMD [&quot;node&quot;, &quot;index.js&quot;]</code> instead change <strong>CMD</strong> to running the <code>CMD [&quot;npm&quot;, &quot;start&quot;]</code>.</p>
<p>Docker/Container will get start the main shell script and it will set all env into OS first. Once all Env is set to shell script will start the application.</p>
<p><strong>package.json</strong></p>
<pre><code>&quot;start&quot;: &quot;./path-to-shscript-in-docker/runapp&quot;,
</code></pre>
<p><strong>runapp</strong></p>
<pre><code>#!/bin/bash
if [ -f '/vault/secrets/secrets' ]; then
  source '/vault/secrets/secrets'
fi
node &lt;path-insnide-docker&gt;/index.js 
</code></pre>
<p>The issue with the lifecycle hook is that there is no guarantee, so it would be better to call the <strong>source</strong> before the app start.</p>
