Support for an agent-image built FROM scratch

[aiman-alsari]

In heavily regulated environments, adding unnecessary dependencies makes things more difficult to maintain and increases the attack surface of a container.
Therefore it makes sense to have a vault agent image that is purpose-built and has no other tools other than the vault binary (ideally with just the agent component rather than an uber-binary, but that's a different story).

The injector allows us to provide our own image using the agent-image annotation. Whilst this is super handy, the container is defined as such in agent-inject/agent/container_sidecar.go:

        newContainer := corev1.Container{
                Name:         "vault-agent",
                Image:        a.ImageName,
                Env:          envs,
                Resources:    resources,
                VolumeMounts: volumeMounts,
                Lifecycle:    &lifecycle,
                Command:      []string{"/bin/sh", "-ec"},
                Args:         []string{arg},
        }

        DefaultContainerArg       = "echo ${VAULT_CONFIG?} | base64 -d > /home/vault/config.json && vault agent -config=/home/vault/config.json"

Which relies on a shell, echo, and base64 binaries.

I did investigate using the vault.hashicorp.com/agent-configmap annotation, but this has a similar problem in that it runs /bin/sh as the command and also relies on the touch command to be present:

        if a.ConfigMapName != "" {
                volumeMounts = append(volumeMounts, corev1.VolumeMount{
                        Name:      configVolumeName,
                        MountPath: configVolumePath,
                        ReadOnly:  true,
                })
                arg = fmt.Sprintf("touch %s && vault agent -config=%s/config.hcl", TokenFile, configVolumePath)
        }

(as a side-note, it's not clear what the TokenFile is for and why it requires touch)

Getting the config into the agent surely could be done either by a configmap volume (either generated or user-provided) or alternatively by modifying the way Vault agent loads its config to support b64 encoded env vars. Then we could run the container without any external dependencies.