apiVersion: apps/v1
kind: Deployment
metadata:
  name: mypod
  namespace: vaultapp
  labels:
    app: mypod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mypod
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "myapp-role"
        vault.hashicorp.com/namespace: "myns_vault"
        vault.hashicorp.com/agent-inject-secret-database-config.txt: "secret/data/database/config"
        vault.hashicorp.com/agent-inject-template-database-config.txt: |
          {{- with secret "secret/data/database/config" -}}
          postgres://{{ .Data.data.username }}:{{ .Data.data.password }}@postgres:5432/mydb?sslmode=disable
          {{- end }}          
      labels:
        app: mypod
    spec:
      serviceAccountName: internal-app
      containers:
        - name: mypod
          image: busybox
          command:
            - sleep
            - "3600"
