What Is a Vault Agent Injector?

A vault agent injector is an admission webhook that mutates annotated pods to add a vault agent sidecar. The sidecar authenticates to Vault using the pods identity, retrieves the requested secrets, and renders them into a shared in-memory volume that the app container reads. It keeps secrets out of the cluster secret store and renews them as they expire.

Why it matters

Injection delivers short-lived, dynamically generated secrets to apps without baking them into images or env vars. The sidecar also handles renewal so leases do not lapse during long runs.

Related guides