apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-secrets
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-secrets
  template:
    metadata:
      labels:
        app: hello-secrets
      annotations:
        vault.security.banzaicloud.io/vault-addr: "https://vault:8200"
        vault.security.banzaicloud.io/vault-tls-secret: vault-tls
        # vault.security.banzaicloud.io/vault-skip-verify: "false"
        # vault.security.banzaicloud.io/vault-role: "default"
        # vault.security.banzaicloud.io/vault-path: "kubernetes"
        # vault.security.banzaicloud.io/vault-agent: "true"
    spec:
      initContainers:
      - name: init-ubuntu
        image: ubuntu
        command: ["sh", "-c", "echo $AWS_SECRET_ACCESS_KEY && echo initContainers ready"]
        env:
        - name: AWS_SECRET_ACCESS_KEY
          value: vault:secret/data/accounts/aws#AWS_SECRET_ACCESS_KEY
        resources:
          limits:
            memory: "128Mi"
            cpu: "100m"
      containers:
      - name: alpine
        image: alpine
        command: ["sh", "-c", "echo $AWS_SECRET_ACCESS_KEY && echo going to sleep... && sleep 10000"]
        env:
        - name: AWS_SECRET_ACCESS_KEY
          value: vault:secret/data/accounts/aws#AWS_SECRET_ACCESS_KEY
        resources:
          limits:
            memory: "128Mi"
            cpu: "100m"
      - name: mysql
        image: mysql # see that containers without explicit command can work
        env:
        - name: MYSQL_ROOT_PASSWORD
          value: vault:secret/data/mysql#MYSQL_ROOT_PASSWORD
        ports:
        - name: mysql
          containerPort: 3306
        resources:
          limits:
            memory: "128Mi"
            cpu: "100m"
      # imagePullSecrets:
      # - sample-secret
