apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app: myjob
  name: myjob
spec:
  template:
    metadata:
      annotations:
        admission.trusted.identity/inject: "true"
        tsi.secrets: |
             - tsi.secret/name: "mysecret1"
               tsi.secret/constraints: "region,images"
               tsi.secret/local-path: "tsi-secrets/"
    spec:
      containers:
        - name: myjob
          image: ubuntu@sha256:250cc6f3f3ffc5cdaa9d8f4946ac79821aafb4d3afc93928f0de9336eba21aa4
          imagePullPolicy: Always
          command: [ "/bin/bash", "-c", "--" ]
          args: [ "ls /tsi-secrets; sleep 15;cat /tsi-secrets/mysecret1;sleep 5;cat /tsi-secrets/mysecret1" ]
      restartPolicy: Never
  backoffLimit: 4
