apiVersion: v1
kind: ConfigMap
metadata:
  name: sidecar-agent
data:
  sidecarconfig.yaml: |
    template: |-
      volumeMounts:
      - mountPath: /var/run/secrets/vaultproject.io
        name: vault-agent-volume
      containers:
      - image: vault:latest
        name: vault-agent
        args:
        - agent
        - -log-level=debug
        - -config=/vault/config/agent.config
        env:
        - name: SKIP_SETCAP
          value: 'true'
        - name: VAULT_ADDR
          value: https://vault.hashicorp-vault.svc:8200
        - name: VAULT_CAPATH
          value: /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
        volumeMounts:
        - mountPath: /vault/config/agent.config
          subPath: agent.config
          name: vault-config
        - mountPath: /var/run/secrets/vaultproject.io
          name: vault-agent-volume
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: {{ .TokenVolume }}
        securityContext:
          capabilities:
            drop:
              - KILL
              - MKNOD
              - SETGID
              - SETUID
          privileged: false
          runAsNonRoot: true
          RunAsUser: {{ .Container.SecurityContext.RunAsUser }}
      - image: openlabred/vault-secret-fetcher:v1.0.1
        name: vault-secret-fetcher
        args:
          - start
        env:
          - name: LOG_LEVEL
            value: 'DEBUG'
          - name: VAULT_ADDR
            value: https://vault.hashicorp-vault.svc:8200
          - name: VAULT_CAPATH
            value: /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
          - name: VAULT_TOKEN
            value: /var/run/secrets/vaultproject.io/token
          - name: VAULT_SECRET
            value: {{ .VaultSecret }}
          - name: PROPERTIES_FILE
            value: /var/run/secrets/vaultproject.io/application.{{ .PropertiesExt }}
        imagePullPolicy: Always
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /var/run/secrets/vaultproject.io
          name: vault-agent-volume
        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          name: {{ .TokenVolume }}
          readOnly: true
        securityContext:
          capabilities:
            drop:
              - KILL
              - MKNOD
              - SETGID
              - SETUID
          privileged: false
          runAsNonRoot: true
          RunAsUser: {{ .Container.SecurityContext.RunAsUser }}
      volumes:
      - name: vault-agent-volume
        emptyDir:
          medium: Memory
      - configMap:
          items:
            - key: vault-agent-config
              path: agent.config
          name: vault-agent-config-{{ .Name }}
        name: vault-config
    vault-agent-config: |-
      pid_file = "/var/run/secrets/vaultproject.io/pid"

      auto_auth {
              method "kubernetes"  {
                      type = "kubernetes"
                      mount_path = "auth/kubernetes"
                      config = {
                              role = "{{ .VaultRole }}"
                              jwt = "@/var/run/secrets/kubernetes.io/serviceaccount/token"
                      }
              }

              sink "file" {
                      type = "file"
                      config = {
                              path = "/var/run/secrets/vaultproject.io/token"
                      }
              }
      }
