Inject Vault secrets into Kubernetes pods using the Vault Agent sidecar injector

Steps

1. Install Vault Agent Injector via the HashiCorp Vault Helm chart with `injector.enabled=true`; configure it to point to your Vault address
2. Enable Kubernetes authentication in Vault and create a role binding your pod's ServiceAccount and namespace to a Vault policy
3. Annotate your pod template with `vault.hashicorp.com/agent-inject: 'true'`, `vault.hashicorp.com/role: YOUR_ROLE`, and one `vault.hashicorp.com/agent-inject-secret-<filename>` annotation per secret path
4. Optionally use a template annotation to control the rendered file format (e.g., export KEY=value shell syntax or JSON) inside the injected secret file
5. Deploy the workload — the mutating webhook injects an init container that logs in to Vault, fetches secrets, and writes them to a shared in-memory volume before the app container starts
6. For long-running pods, the sidecar agent container continues running to renew leases and refresh rotating secrets without restarting the app