---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-token: "true"
        vault.hashicorp.com/auth-type: "jwt"
        vault.hashicorp.com/auth-path: "auth/jwt"
        vault.hashicorp.com/auth-config-path: "/var/run/secrets/vault.hashicorp.com/serviceaccount/token"
        vault.hashicorp.com/agent-service-account-token-volume-name: "vault-token"
        vault.hashicorp.com/role: "default"
    spec:
      volumes:
        # Create a token for the default service account with vault as an audience.
        # Note that this matches up with the audience parameter in the jwt auth role config
        - name: vault-token
          projected:
            sources:
            - serviceAccountToken:
                path: token
                expirationSeconds: 7200
                audience: vault
      containers:
      - image: nginx
        name: nginx
