---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-kubernetes-synchronizer
  labels:
    appl: vault-kubernetes-synchronizer
spec:
  replicas: 1
  selector:
    matchLabels:
      appl: vault-kubernetes-synchronizer
  template:
    metadata:
      labels:
        appl: vault-kubernetes-synchronizer
    spec:
      serviceAccountName: ${SERVICEACCOUNT}
      volumes:
      - name: vault-token
        emptyDir:
          medium: Memory
      initContainers:
      - name: vault-kubernetes-authenticator
        image: ${AUTHENTICATOR_IMAGE}
        imagePullPolicy: Always
        volumeMounts:
        - name: vault-token
          mountPath: ${VAULT_TOKEN_DIR}
        env:
        - name: VAULT_ADDR
          value: ${VAULT_ADDR}
        - name: VAULT_SKIP_VERIFY
          value: "true"
        - name: VAULT_AUTH_MOUNT_PATH
          value: ${VAULT_AUTH_MOUNT_PATH}
        - name: VAULT_ROLE
          value: ${VAULT_ROLE}
        - name: VAULT_TOKEN_PATH
          value: ${VAULT_TOKEN_PATH}
        - name: ALLOW_FAIL
          value: "true"
      - name: vault-kubernetes-synchronizer
        image: ${SYNCHRONIZER_IMAGE}
        imagePullPolicy: Always
        volumeMounts:
        - name: vault-token
          mountPath: ${VAULT_TOKEN_DIR}
        env:
        - name: VAULT_ADDR
          value: ${VAULT_ADDR}
        - name: VAULT_SKIP_VERIFY
          value: "true"
        - name: VAULT_TOKEN_PATH
          value: ${VAULT_TOKEN_PATH}
        - name: SECRET_PREFIX
          value: "v3t_"
        - name: VAULT_SECRETS
          value: secret/data/${CLUSTER}/${NAMESPACE}/first,secret/data/${CLUSTER}/${NAMESPACE}/second,secret/data/${CLUSTER}/${NAMESPACE}/first:third,secret/data/${CLUSTER}/${NAMESPACE}/greek/
      containers:
      - name: kuard
        image: ${IMAGE}
        volumeMounts:
        - name: vault-token
          mountPath: ${VAULT_TOKEN_DIR}

