Access to the secret.properties about vault-sidecar-injector

[asaintsever]

Hello,

Internally the feature depends on the secrets file so it is not possible to not "have the secrets file in the pods" but this is totally transparent, you even don't need to explicitly mount a volume.

Why is it an issue to you? Your process already has access to the secrets via the env vars, why would it be more secure to not have them in files? FYI, the secrets are mounted in a memory volume (not a persistent storage) that only containers in your pod can see and access to.

What I can do though is to delete those secrets files once env vars are initialized (just before your process is run). Will consider that improvement for next patch release.

[asaintsever]

After second thought, removing secrets file as I proposed is not a good idea from a resiliency standpoint. If your container restarts, those files will be required to reinject the secrets as env vars in your process.

I will close this ticket as internal implementation depends on those files and there's no security issue keeping them.