apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-env-gcp-auth
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vault-env-gcp-auth
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault-env-gcp-auth
      annotations:
        # These annotations enable Vault GCP GCE auth, see:
        # https://www.vaultproject.io/docs/auth/gcp#gce-login
        vault.security.banzaicloud.io/vault-addr: "https://vault:8200"
        vault.security.banzaicloud.io/vault-tls-secret: vault-tls
        vault.security.banzaicloud.io/vault-role: "my-role"
        vault.security.banzaicloud.io/vault-path: "gcp"
        vault.security.banzaicloud.io/vault-auth-method: "gcp-gce"
    spec:
      containers:
        - name: alpine
          image: alpine
          command:
            [
              "sh",
              "-c",
              "echo $MYSQL_PASSWORD && echo going to sleep... && sleep 10000",
            ]
          resources:
            limits:
              memory: "64Mi"
              cpu: "100m"
          env:
            - name: MYSQL_PASSWORD
              value: vault:secret/data/mysql#MYSQL_PASSWORD
#             # If you wish to supply your own GOOGLE_APPLICATION_CREDENTIALS file to the Pod,
#             # and bypass automatic authentication, uncomment the following lines:
#
#             - name: GOOGLE_APPLICATION_CREDENTIALS
#               value: /etc/gcp/credentials.json
#           volumeMounts:
#             - name: gcp-secret
#               mountPath: "/etc/gcp/"
#               readOnly: true
#       volumes:
#         - name: gcp-secret
#           secret:
#             secretName: gcp-secret

# ---

# apiVersion: v1
# kind: Secret
# metadata:
#   name: gcp-secret
# type: Opaque
# data:
#   credentials.json: "YOUR_SERVICE_ACCOUNT_JWT_IN_BASE64"
