---
apiVersion: v1
kind: Pod
metadata:
  name: toolbox
spec:
  serviceAccountName: client
  containers:
  - name: toolbox
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: client-secret
