Vault sidecar type annotation

[liad5h]

No description provided.

[hashicorp-cla]

All committers have signed the CLA.

[thyton]

@liad5h Thank you for taking this on and being patient! The PR is generally on a good path :). I have some change requests. I'm happy to sync up and help out with addressing them if you need.

Would you mind dropping a small description in the PR and something like below in CHANGELOG.md under Unreleased?

Improvements:
* Add support to configure sidecar type (proxy or agent) and proxy's auto auth token use through Pod Annotations [GH-496](https://github.com/hashicorp/vault-k8s/pull/496)

[thyton]

Could you revert the accidental space?

[thyton]

Suggested change

	if a.SidecarType != "" && !(a.SidecarType == "agent" || a.SidecarType == "proxy") {
	if a.SidecarType != "" && (a.SidecarType == "agent" || a.SidecarType == "proxy") {

I think you meant if a.SidecarType is not empty, and a.SidecarType is "agent" or "proxy", then return a.SidecarType?

[thyton]

Could we also add a similar assertion for agent.ProxyUseAutoAuthToken?

[thyton]

Could you add different test cases under TestContainerSidecar() to test varying annotation sets containing 2 new annotations?

vault-k8s/agent-inject/agent/annotations.go

Lines 20 to 28 in 412e109

	// AnnotationAgentSidecarType is the key of the annotation that controls whether
	// a Vault agent or Vault proxy is injected into the pod
	// Should be set to one of "agent" / "proxy", defaults to "agent".
	AnnotationAgentSidecarType = "vault.hashicorp.com/sidecar-type"
	// AnnotationAgentProxyUseAutoAuthToken is the key of the annotation that controls whether
	// the auto auth token should be used in the vault proxy.
	// configures the "use_auto_auth_token" key in the "api_proxy" stanza.
	AnnotationAgentProxyUseAutoAuthToken = "vault.hashicorp.com/sidecar-proxy-use-auto-auth-token"

vault-k8s/agent-inject/agent/container_sidecar_test.go

Lines 210 to 216 in 412e109

	func TestContainerSidecar(t *testing.T) {
	annotations := map[string]string{
	AnnotationVaultRole: "foobar",
	}
	pod := testPod(annotations)

[rathberm]

@thyton is this the official pr for this topic? Vault agent api proxy will be removed in 2026 Q2, I think this will break a lot of use-cases of this project.
I'd be willing to take this on if you are not working on it already.