---
apiVersion: v1
kind: Pod
metadata:
  name: secret-demo
spec:
  containers:
    - name: test-container1
      image: k8s.gcr.io/busybox
      command: [ "/bin/sh", "-c", "ls /etc/secret" ]
      volumeMounts:
        - name: secret
          mountPath: /etc/secret
          readOnly: true
    - name: test-container2
      image: k8s.gcr.io/busybox
      command: [ "/bin/sh", "-c", "env" ]
      envFrom:
        - secretRef:
            name: secret
  volumes:
    - name: secret
      secret:
        secretName: secret
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          # OR
          - matchExpressions:
            # AND
            - key: beta.kubernetes.io/instance-type
              operator: NotIn
              values:
                - f1-micro
  restartPolicy: Never
