apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-app6
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      com.talend.application: test
      com.talend.service: test-app-svc
  template:
    metadata:
      annotations:
        sidecar.vault.talend.org/inject: "true"
        sidecar.vault.talend.org/mode: "secrets,proxy"  # Enable both 'secrets' and 'proxy' modes
        sidecar.vault.talend.org/secrets-type: "static" # static secrets
      labels:
        com.talend.application: test
        com.talend.service: test-app-svc
    spec:
      serviceAccountName: default
      containers:
        - name: test-app6-container
          image: everpeace/curl-jq
          command:
            - "sh"
            - "-c"
            - |
              set -e
              echo "My secrets are: $(cat /opt/talend/secrets/secrets.properties)"
              echo
              echo "Now using Vault Agent as a proxy to leverage Encryption as a Service feature (will encrypt and decrypt our secrets here)"
              echo "Advantage: you do not need to deal with any Vault tokens and you just have to send requests to the local Vault Agent sidecar (available at 127.0.0.1) that will then forward everything to Vault server."
              echo

              isVaultReady=$(curl -s -X GET http://127.0.0.1:8200/v1/sys/health | jq --raw-output .initialized)
              while [ "$isVaultReady" != "true" ];do
                sleep 5
                isVaultReady=$(curl -s -X GET http://127.0.0.1:8200/v1/sys/health | jq --raw-output .initialized)
              done

              plaintext=$(cat /opt/talend/secrets/secrets.properties | grep SECRET1)
              echo "Data that is going to be ciphered and deciphered: $plaintext"
              echo
              b64Plaintext=$(echo "$plaintext" | base64)
              
              ciphertext=$(curl -s -X POST --data "{\"plaintext\": \"$b64Plaintext\"}" http://127.0.0.1:8200/v1/transit/encrypt/test-key | jq --raw-output .data.ciphertext)
              echo "Ciphertext"
              echo "=========="
              echo "$ciphertext"
              echo
              
              cleartext=$(curl -s -X POST --data "{\"ciphertext\": \"$ciphertext\"}" http://127.0.0.1:8200/v1/transit/decrypt/test-key | jq --raw-output .data.plaintext)
              echo "Cleartext"
              echo "=========="
              echo "$cleartext" | base64 -d
              echo
              while true;do
                sleep 5
              done
          volumeMounts:
            - name: secrets
              mountPath: /opt/talend/secrets
      volumes:
        - name: secrets
          emptyDir:
            medium: Memory