apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  namespace: app
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: app
  template:
    metadata:
      labels:
        app.kubernetes.io/name: app
      annotations:
        vault.security.banzaicloud.io/vault-addr: "https://vault.vault:8200"
        vault.security.banzaicloud.io/vault-tls-secret: vault-tls
    spec:
      # initContainers only works if Vault is having PERMISSIVE authentication policy in Istio
      initContainers:
        - name: init-ubuntu
          image: ubuntu
          command:
            [
              "sh",
              "-c",
              "echo $AWS_SECRET_ACCESS_KEY && echo initContainers ready",
            ]
          env:
            - name: AWS_SECRET_ACCESS_KEY
              value: vault:secret/data/accounts/aws#${.AWS_SECRET_ACCESS_KEY} # Go templates are also supported with ${} delimiters
      containers:
        - name: app
          image: alpine
          command:
            [
              "sh",
              "-c",
              "echo $AWS_SECRET_ACCESS_KEY && echo going to sleep... && sleep 10000",
            ]
          env:
            - name: AWS_SECRET_ACCESS_KEY
              value: vault:secret/data/accounts/aws#AWS_SECRET_ACCESS_KEY
