---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-inject-example
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-inject-example-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vault-inject-example
  template:
    metadata:
      labels:
        app: vault-inject-example
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "vault-example"
        vault.hashicorp.com/agent-inject-secret-env: "vault-example/creds"
        vault.hashicorp.com/auth-path: "auth/kubernetes-local"
        vault.hashicorp.com/agent-inject-template-env: |
          {{- with secret "vault-example/creds" -}}
          {{- range $key, $value := .Data.data }}
          export {{ $key }}={{ $value }}
          {{- end }}
          {{- end }}
    spec:
      containers:
        - name: app
          image: "postgres:latest"
          env:
            - name: POSTGRES_PASSWORD
              value: admin
      serviceAccountName: vault-inject-example