We are using vault injection to source environment variables during container startup.

We only have a need to do this during startup, and do not need to retrieve updates after that point. We have been looking for a way to disable the sidecar injection, but have been unsuccessful so far.

The documentation states the following (emphasis mine):

Next, two types of Vault Agent containers can be injected: init and sidecar. The init container will prepopulate the shared memory volume with the requested secrets prior to the other containers starting. The sidecar container will continue to authenticate and render secrets to the same location as the pod runs. Using annotations, the initialization and sidecar containers may be disabled.

and that’s the last it’s mentioned. It does not state anywhere which annotations accomplish this, and on the documentation page for annotations does not seem to list any annotations that accomplish this.

Has anyone been able to get this working?