apiVersion: v1
kind: Pod
metadata:
  name: nginx
  namespace: default
  labels:
    run: my-nginx
spec:
  serviceAccountName: vault-auth

  volumes:
  - configMap:
      items:
      - key: vault-agent-config.hcl
        path: vault-agent-config.hcl
      name: example-vault-agent-config-nginx
    name: config
  - configMap:
      items:
      - key: ssl.conf
        path: ssl.conf
      name: nginx-config
    name: nginx-config
  - emptyDir: {}
    name: shared-secrets
  - emptyDir: {}
    name: shared-data

  initContainers:
  - args:
    - agent
    - -config=/etc/vault/vault-agent-config.hcl
    - -log-level=debug
    env:
    - name: VAULT_ADDR
      value: https://vault:8200
    - name: VAULT_CACERT
      value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    image: vault
    name: vault-agent
    volumeMounts:
    - mountPath: /etc/vault
      name: config
    - mountPath: /etc/secrets
      name: shared-secrets
    - mountPath: /etc/secrets_html
      name: shared-data

  containers:
  - image: nginx
    name: nginx-container
    ports:
    - containerPort: 80
    - containerPort: 443
    volumeMounts:
    - mountPath: /usr/share/nginx/html
      name: shared-data
    - mountPath: /etc/nginx/certs
      name: shared-secrets
    - mountPath: /etc/nginx/conf.d
      name: nginx-config
