apiVersion: v1
kind: Pod
metadata:
  name: web
  labels:
    app: web
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "renew-pki"
    vault.hashicorp.com/agent-inject-secret-server.crt: "pki_int/issue/example-dot-ru"
    vault.hashicorp.com/agent-inject-template-server.crt: |
      {{- with secret "pki_int/issue/example-dot-ru" "common_name=nginx.example.ru" "ttl=30s" -}}
      {{ .Data.certificate }}
      {{- end }}
    vault.hashicorp.com/agent-inject-secret-server.key: "pki_int/issue/example-dot-ru"
    vault.hashicorp.com/agent-inject-template-server.key: |
      {{- with secret "pki_int/issue/example-dot-ru" "common_name=nginx.example.ru" "ttl=30s" -}}
      {{ .Data.private_key }}
      {{- end }}
    vault.hashicorp.com/ca-cert: "/run/secrets/kubernetes.io/serviceaccount/ca.crt"
spec:
  serviceAccountName: vault-auth
  containers:
    - name: web
      image: dmizverev/nginx-ssl:1.1.0
      env:
        - name: NGINX_HOST
          value: nginx.example.com
        - name: NGINX_CRT
          value: /vault/secrets/server.crt
        - name: NGINX_KEY
          value: /vault/secrets/server.key
      volumeMounts:
        - name: app
          mountPath: /app
      readinessProbe:
        httpGet:
          path: /index.html
          port: 8000
          scheme: HTTPS
      livenessProbe:
        exec:
          command:
            - nginx
            - -s
            - reload
  initContainers:
    - name: init-web
      image: busybox:1.31.0
      command: ['sh', '-c', 'wget -O- https://raw.githubusercontent.com/express42/otus-platform-snippets/master/Module-02/Introduction-to-Kubernetes/wget.sh | sh']
      volumeMounts:
        - name: app
          mountPath: /app
  volumes:
    - name: app
      emptyDir: {}
