CSPL-2600 Fixing Vault notifications not to create a token dir and store just a value

Author: kasiakoziol

pkg/splunk/client/vault_setup.go

@@ -129,7 +129,6 @@ func InjectVaultSecret(ctx context.Context, client splcommon.ControllerClient, s
 		return fmt.Errorf("vault secretPath is required when vault is enabled")
 	}
 
-	secretPath := vaultSpec.SecretPath
 	vaultRole := vaultSpec.Role
 	secretKeyToEnv := []string{
 		"hec_token",
@@ -183,7 +182,7 @@ func InjectVaultSecret(ctx context.Context, client splcommon.ControllerClient, s
 				},
 			},
 		}
-	} 
+	}
 
 	splunkConfigYAML, err := yaml.Marshal(splunkConfig)
 	if err != nil {
@@ -198,12 +197,15 @@ func InjectVaultSecret(ctx context.Context, client splcommon.ControllerClient, s
 	annotations["vault.hashicorp.com/secret-volume-path-defaults"] = "/mnt/splunk-secrets"
 	annotations["vault.hashicorp.com/agent-inject-template-defaults"] = splunkConfigString
 	for _, key := range secretKeyToEnv {
-		annotationKey := fmt.Sprintf("vault.hashicorp.com/agent-inject-secret-%s", key)
-		annotations[annotationKey] = fmt.Sprintf("%s/%s", secretPath, key)
+		annotationKey := fmt.Sprintf("vault.hashicorp.com/agent-inject-template-%s", key)
+		annotations[annotationKey] = fmt.Sprintf("'{{- with secret \"secret/data/splunk/%s\" -}}{{ .Data.value }}{{- end }}'", key)
+		if kvVersion == "2" {
+			annotations[annotationKey] = fmt.Sprintf("'{{- with secret \"secret/data/splunk/%s\" -}}{{ .Data.data.value }}{{- end }}'", key)
+		}
 		annotationFile := fmt.Sprintf("vault.hashicorp.com/agent-inject-file-%s", key)
 		annotations[annotationFile] = key
 		annotationVolumeKey := fmt.Sprintf("vault.hashicorp.com/secret-volume-path-%s", key)
-		annotations[annotationVolumeKey] = fmt.Sprintf("/mnt/splunk-secrets/%s", key)
+		annotations[annotationVolumeKey] = "/mnt/splunk-secrets"
 	}
 
 	// Apply these annotations to the StatefulSet PodTemplateSpec without overwriting existing ones
@@ -404,7 +406,7 @@ func GetSpecificSecretTokenFromVault(ctx context.Context, c splcommon.Controller
 		password = metadataResponse.Data.Value
 	} else if kvVersion == "2" {
 		password = metadataResponse.Data.Data.Value
-	} 
+	}
 
 	return password, nil
 }