#556 Implement ability to specify additional/override annotations when using Vault Secret Manager Pull request opened by pradithya TL;DR Add

annotations

configuration to the Vault Secret Manager to provide better flexibility when integrating with Vault. Type ☐ Bug Fix ☑︎ Feature ☐ Plugin Are all requirements met? ☑︎ Code completed ☑︎ Smoke tested ☑︎ Unit tests added ☑︎ Code documentation added ☑︎ Any pending items have an associated Issue Complete description When the Vault secret manager is enabled, flyte-pod-webhook is responsible for adding vault-specific annotation to the task pod that requests secret variables. These annotations are used to configure the Vault Agent behavior when retrieving and populating the secret from Vault. As of now, the annotation provided by

flyte-pod-webhook

is limited to the one implemented in

vault_secret_manager.go

. This PR allows Flyte administrator to add additional or override default annotations providing better flexibility to customize Vault agent behavior. For example, the following configuration will set the Vault agent authentication type to use GCP and to immediately exit if the authentication failed.

vaultSecretManager:
        kvVersion: "2"
        role: flyte
        annotations:
          <http://vault.hashicorp.com/auth-config-type|vault.hashicorp.com/auth-config-type> : "gce"
          <http://vault.hashicorp.com/auth-type|vault.hashicorp.com/auth-type> : "gcp"
          <http://vault.hashicorp.com/agent-auto-auth-exit-on-err|vault.hashicorp.com/agent-auto-auth-exit-on-err> : "true"

Tracking Issue NA Follow-up issue NA flyteorg/flytepropeller GitHub Actions: Build & Push Flytepropeller Image GitHub Actions: Goreleaser GitHub Actions: Bump Version ✅ 11 other checks have passed 11/14 successful checks