apiVersion: v1
kind: Pod
metadata:
  name: secret-pod
spec:
  containers:
  - name: hello
    image: eu.gcr.io/YOUR_PROJECT_ID/hello-node:v1
    env:
    - name: SECRET_ENV
      valueFrom:
        secretKeyRef:
          name: db-pass
          key: password
    volumeMounts:
      - name: secrets
        mountPath: /etc/mysecrets
        readOnly: true
  volumes:
    - name: secrets
      secret:
        secretName: db-pass
  restartPolicy: Never
