apiVersion: batch/v1
kind: Job
metadata:
  name: printenv-job
spec:
  template:
    spec:
      restartPolicy: Never
      # create K8s iam-secrets-manager-ro SA and bind it to AWS IAM role
      # with permissions to access AWS Secrets Manager and AWS SSM Parameter Store
      #
      #   kubectl create serviceaccount --namespace default iam-secrets-manager-ro
      #   kubectl annotate serviceaccounts iam-secrets-manager-ro amazonaws.com/role-arn=<ROLE-ARN>
      serviceAccountName: iam-secrets-manager-ro
      containers:
      - image: alpine:3
        name: print-env
        env:
          - name: AWS_REGION
            value: us-west-2
          - name: NOT_A_SECRET
            value: hello
          - name: TOP_SECRET
            value: arn:aws:secretsmanager:us-west-2:906364353610:secret:myamazingsupersecret-Bccaq7
          - name: FROM_K8S_SECRET
            valueFrom:
              secretKeyRef:
                name: secret-from-aws
                key: top-secret
          - name: FROM_K8S_CONFIGMAP
            valueFrom:
              configMapKeyRef:
                name: cm-from-aws
                key: top-secret
        args:
          - printenv
          - NOT_A_SECRET
          - TOP_SECRET
          - FROM_K8S_SECRET
          - FROM_K8S_CONFIGMAP
