apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
  generation: 1
  labels:
    app: sleeper
  name: sleeper
  namespace: secret-watcher
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: sleeper
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: sleeper
    spec:
      containers:
      - image: docker.io/busybox
        command:
        - /bin/sh
        - -c
        - sleep infinity
        imagePullPolicy: IfNotPresent
        name: sleeper
        resources:
          limits:
            cpu: 2m
            memory: 20Mi
          requests:
            cpu: 1m
            memory: 2Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        # k create secret generic secret --from-literal=foo=bar --namespace=$n
        # k -n $n exec pod/$pod -- '/bin/sh' '-c' 'cat secret/foo'
        volumeMounts:
        - mountPath: "/secret"
          name: secret
          readOnly: true
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccountName: secret-watcher
      terminationGracePeriodSeconds: 30
      volumes:
      - name: secret-volume
        secret:
          defaultMode: 420
          secretName: secret
