app.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-awesome-app
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-awesome-app
  labels:
    app: my-awesome-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-awesome-app
  template:
    metadata:
      labels:
        app: my-awesome-app
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "awesome-app"
        vault.hashicorp.com/agent-inject-secret-credentials.txt: "secret/my-awesome-app/config"
        vault.hashicorp.com/agent-inject-template-credentials.txt: |
          {{- with secret "secret/my-awesome-app/config" -}}
          username: {{ .Data.data.username }}
          password: {{ .Data.data.password }}
          {{ end -}}
    spec:
      serviceAccountName: sa-awesome-app
      containers:
      - name: app
        image: sylwit/http_filereader:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
        env:
        - name: FILEREADER_CHROOT
          value: /vault/secrets
---
apiVersion: v1
kind: Service
metadata:
  name: my-awesome-svc
spec:
  type: NodePort
  selector:
    app: my-awesome-app
  ports:
    - protocol: TCP
      port: 8080
      targetPort: 8080
      nodePort: 30100