Add agent-inject-containers annotation

agent-inject/agent/agent.go

@@ -383,8 +383,22 @@ func (a *Agent) Patch() ([]byte, error) {
 			"/spec/volumes")...)
 	}
 
-	//Add Volume Mounts
+	//Add Volume Mounts to desired containers
+	raw, ok := a.Pod.Annotations[AnnotationAgentInjectContainers];
+	if !ok {
+		return patches, fmt.Errorf("vault.hashicorp.com/agent-inject-containers annotation not found")
+	}
+
+	names := make(map[string]struct{})
+	for _, name := range strings.Split(raw, ",") {
+		names[name] = struct{}{}
+	}
+
 	for i, container := range a.Pod.Spec.Containers {
+		if _, ok := names[container.Name]; !ok {
+			continue
+		}
+
 		a.Patches = append(a.Patches, addVolumeMounts(
 			container.VolumeMounts,
 			a.ContainerVolumeMounts(),

agent-inject/agent/annotations.go

@@ -56,6 +56,12 @@ const (
 	// If not provided (the default), no command is executed.
 	AnnotationAgentInjectCommand = "vault.hashicorp.com/agent-inject-command"
 
+	// AnnotationAgentInjectContainers is the key of the annotation that controls
+	// in which containers the secrets volume should be mounted. Multiple containers can
+	// be specificied in a comma-separated list. If not provided, the secrets volume will
+	// be mounted in all containers in the pod.
+	AnnotationAgentInjectContainers = "vault.hashicorp.com/agent-inject-containers"
+
 	// AnnotationAgentImage is the name of the Vault docker image to use.
 	AnnotationAgentImage = "vault.hashicorp.com/agent-image"
 
@@ -324,6 +330,16 @@ func Init(pod *corev1.Pod, cfg AgentConfig) error {
 		pod.ObjectMeta.Annotations[AnnotationAgentCacheUseAutoAuthToken] = DefaultAgentCacheUseAutoAuthToken
 	}
 
+	// If the AnnotationAgentInjectContainers annotation is not set, default to all containers
+	if _, ok := pod.ObjectMeta.Annotations[AnnotationAgentInjectContainers]; !ok {
+		containerNames := make([]string, len(pod.Spec.Containers))
+		for i, v := range pod.Spec.Containers {
+			containerNames[i] = v.Name
+		}
+
+		pod.ObjectMeta.Annotations[AnnotationAgentInjectContainers] = strings.Join(containerNames, ",")
+	}
+
 	return nil
 }
 

agent-inject/agent/annotations_test.go

@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"encoding/json"
 	"fmt"
 	"reflect"
 	"strconv"
@@ -793,3 +794,75 @@ func Test_runAsSameID(t *testing.T) {
 		})
 	}
 }
+
+func TestInjectContainers(t *testing.T) {
+	expectedPatch := "{\"op\":\"add\",\"path\":\"/spec/containers/0/volumeMounts/-\",\"value\":{\"mountPath\":\"/vault/secrets\",\"name\":\"vault-secrets\"}}"
+
+	tests := []struct {
+		name 		string
+		annotations map[string]string
+		expected    string
+		hasPatch    bool
+	}{
+		{
+			name: 		 "No InjectContainers annotation",
+			annotations: map[string]string{},
+			expected: 	 "foobar",
+			hasPatch:    true,
+		},
+		{
+			name: 		 "InjectContainers annotation with container name",
+			annotations: map[string]string{AnnotationAgentInjectContainers: "baz"},
+			expected: 	 "baz",
+			hasPatch:    false,
+		},
+		{
+			name: 		 "Empty InjectContainers annotation",
+			annotations: map[string]string{AnnotationAgentInjectContainers: ""},
+			expected: 	 "",
+			hasPatch:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pod := testPod(tt.annotations)
+			var patches []*jsonpatch.JsonPatchOperation
+
+			agentConfig := AgentConfig{
+				"foobar-image", "http://foobar:8200", "test", "test", true, "100", "1000",
+				DefaultAgentRunAsSameUser, DefaultAgentSetSecurityContext,
+			}
+
+			err := Init(pod, agentConfig)
+			if err != nil {
+				t.Errorf("got error, shouldn't have: %s", err)
+			}
+
+			agent, err := New(pod, patches)
+			if err != nil {
+				t.Errorf("got error, shouldn't have: %s", err)
+			}
+
+			patch, err := agent.Patch()
+			if err != nil {
+				t.Errorf("got error, shouldn't have: %s", err)
+			}
+
+			require.Equal(t, pod.Annotations[AnnotationAgentInjectContainers], tt.expected)
+
+			var actual []jsonpatch.JsonPatchOperation
+			json.Unmarshal(patch, &actual)
+
+			// Ensure the container patch is present if it is expected
+			hasPatch := false
+			for _, p := range actual {
+				if p.Json() == expectedPatch {
+					hasPatch = true
+				}
+			}
+
+			require.Equal(t, hasPatch, tt.hasPatch)
+		})
+	}
+}