Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support vault secret inject while the main pod "automountServiceAccountToken" set false #601

Open
TommyLike opened this issue Feb 29, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@TommyLike
Copy link

Is your feature request related to a problem? Please describe.
vault injector works well, but for our security concern, is it possible to inject secret to our deployment pod while the "automountServiceAccountToken" setting false?

Describe the solution you'd like
see above

Describe alternatives you've considered
Nope

Additional context
To eliminate the security concern from our security team who worried that we don't need mount the service account when the main pod does not need to.

@TommyLike TommyLike added the enhancement New feature or request label Feb 29, 2024
@TommyLike
Copy link
Author

Ok, I found the solution myself, steps to disable auto mount the service account in business pod while used by init container

  1. define the prioject volume which use the service account in deployment
  2. add automountServiceAccountToken=false in deployment
  3. add the annotation "vault.hashicorp.com/agent-service-account-token-volume-name: ----the project volume name----"

This configure will make deployment work as expected

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant