<p>I followed <a href="https://developer.hashicorp.com/vault/docs/platform/k8s/injector/examples#environment-variable-example" rel="nofollow noreferrer">this</a> explanation on how to inject vault secrets as environment variables into a Kubernetes container:</p>
<pre><code>---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-deployment
  labels:
    app: web
spec:
  replicas: 1
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
      annotations:
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/role: 'web'
        vault.hashicorp.com/agent-inject-secret-config: 'secret/data/web'
        # Environment variable export template
        vault.hashicorp.com/agent-inject-template-config: |
          {{ with secret &quot;secret/data/web&quot; -}}
            export api_key=&quot;{{ .Data.data.payments_api_key }}&quot;
          {{- end }}
    spec:
      serviceAccountName: web
      containers:
        - name: web
          image: alpine:latest
          command:
            ['sh', '-c']
          args:
            ['source /vault/secrets/config &amp;&amp; &lt;entrypoint script&gt;']
          ports:
            - containerPort: 9090
</code></pre>
<p>The problem with this is approach is that it overrides the entrypoint of the container image (as pointed out <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#define-a-command-and-arguments-when-you-create-a-pod" rel="nofollow noreferrer">here</a>), which I would like to avoid.</p>
<p>Is it possible to import a vault secret as an environment variable without overriding the default command and arguments of my underlying image?</p>
<p>A solution that reliably substitutes <code>&lt;entrypoint script&gt;</code> with the original entrypoint of my image without hardcoding it would also be ok.</p>

Moritz Wolff
<blockquote>
<p>A solution that reliably substitutes  with the
original entrypoint of my image without hardcoding it would also be
ok.</p>
</blockquote>
<p>The linked solution you quoted is an example of such a solution.</p>
<p>To elaborate, let's say your image's original entrypoint is <code>&lt;entrypoint script&gt;</code>. According to Vault docs, you need to source secrets. The solution you shared overrides original entrypoint using <code>command</code>, it became <code>sh -c</code>. Its arguments (<code>args</code>) are specified by  <code>'source /vault/secrets/config &amp;&amp; &lt;entrypoint script&gt;</code>. When the new entrypoint runs, it sources the secrets and runs the original entrypoint.</p>
