apiVersion: v1
data:
  vault-agent-config.hcl: |
    # Comment this out if running as sidecar instead of initContainer
    exit_after_auth = true

    pid_file = "/home/vault/pidfile"

    auto_auth {
        method "kubernetes" {
            mount_path = "auth/kubernetes"
            config = {
                role = "restic"
            }
        }

        sink "file" {
            config = {
                path = "/home/vault/.vault-token"
            }
        }
    }

    template {
    destination = "/etc/secrets/nginx-password"
    contents = <<EOT
    {{- with secret "restic-kv/data/cl2" }}
    {{ .Data.data.nginx }}
    {{ end }}
    EOT
    }

    template {
    destination = "/etc/secrets/restic-id_ecdsa"
    contents = <<EOT
    {{- with secret "restic-kv/data/restic-ssh-privatekey" }}
    {{ .Data.data.id_ecdsa }}
    {{ end }}
    EOT
    }

kind: ConfigMap
metadata:
  name: vault-agent-config-nginx
  namespace: hashitalks
