apiVersion: v1
kind: Pod
metadata:
  name: nats-client
  labels:
    nats_cluster: nats-cluster
spec:
  volumes:
    - name: "token"
      projected:
        sources:
        - secret:
            name: "nats-user-nats-cluster-bound-token"
            items:
              - key: token
                path: "token"
  restartPolicy: Never
  containers:
    - name: nats-ops
      command: ["/bin/sh"]
      image: "wallyqs/nats-ops:latest"
      tty: true
      stdin: true
      stdinOnce: true
      # Service Account Token is mounted via projected volume.
      volumeMounts:
      - name: "token"
        mountPath: "/var/run/secrets/nats.io"
        readOnly: true