apiVersion: v1
kind: Pod
metadata:
  name: vault-example
spec:
  volumes:
    - name: vault-token
      projected:
        sources:
        - serviceAccountToken:
            path: token
            expirationSeconds: 7200
            audience: vault
  containers:
    - name: vault
      image: hashicorp/vault
      env:
        - name: VAULT_ADDR
          value: http://vault:8200
      command:
        - /bin/sh
        - -c
        - |
          export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=default jwt=@/run/secrets/vault.hashicorp.com/serviceaccount/token)"
          vault write cubbyhole/foo bar=baz
          vault read cubbyhole/foo
          sleep 3000
      volumeMounts:
        - mountPath: /run/secrets/vault.hashicorp.com/serviceaccount
          name: vault-token
