apiVersion: v1
kind: Pod
metadata:
  name: mysql-secret
spec:
  containers:
    - name: mysql-secret
      image: mysql
      volumeMounts:
      - name: vol1
        mountPath: "/etc/foo"     # as per task instructions we need to expose password inside a Pod
      env:
      - name: MYSQL_ROOT_PASSWORD 
        valueFrom:
          secretKeyRef:
            name: db-secret
            key: password
  volumes:
  - name: vol1
    secret:
      secretName: db-secret        # thus our secret is stored inside a Pod as file with KEY as a filename and VALUE as file content
                                   # to check run: kubectl exec mysql-secret  -- cat /etc/foo/password
      
