New Secret CRD for Vault Tokens

[andrejvanderzee]

The vault-agent-injector is able to log into a Vault auth method in an (init)-container and share the vault token with the main container through a volume mount. Because vault tokens are now managed by the vault-secrets-operator, the tokens are not directly consumable by the POD anymore.

There are use-cases for PODs that only require a vault token (and not a secret), for example PODs that operate on the Vault directly: taking snapshots, stepping down leaders, etc.

[bryangwilliam]

I am also interested in seeing this feature. Using VSO to generate a vault token for a pod to use directly would be a very helpful feature.