apiVersion: apps/v1
kind: Deployment
metadata:
  name: app3
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      com.talend.application: test
      com.talend.service: test-app-svc
  template:
    metadata:
      annotations:
        # HashiCorp equivalent for: sidecar.vault.talend.org/inject: "true"
        vault.hashicorp.com/agent-inject: "true"
        # Vault role has to be set using annotation below (or through 'vault.hashicorp.com/agent-configmap')
        # With Vault Sidecar Injector you can set role either through the 'com.talend.application' label or 'sidecar.vault.talend.org/role' annotation 
        vault.hashicorp.com/role: "test"
        vault.hashicorp.com/agent-inject-secret-secrets.properties: "secret/test/test-app-svc"
        # Default HashiCorp default template is slightly different, set same template as Vault Sidecar Injector's default
        vault.hashicorp.com/agent-inject-template-secrets.properties: |
          {{ with secret "secret/test/test-app-svc" }}{{ range $k, $v := .Data }}
          {{ $k }}={{ $v }}
          {{ end }}{{ end }}
        # Use annotation below to only have an init container injected (to match Vault Sidecar Injector behavior for static secrets)
        vault.hashicorp.com/agent-pre-populate-only: "true"
      labels:
        com.talend.application: test
        com.talend.service: test-app-svc
    spec:
      serviceAccountName: default
      containers:
        - name: app-container
          image: busybox:1.28
          command:
            - "sh"
            - "-c"
            - >
              while true;do echo "My secrets are: $(cat /vault/secrets/secrets.properties)"; sleep 5; done
