demo-app-inject-postgres.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-app-sa
---
apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: demo-app-inject-postgres
  name: demo-app-inject-postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-app-inject-postgres
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: demo-app-inject-postgres
      annotations:
        # https://developer.hashicorp.com/vault/docs/platform/k8s/injector
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "test"
        vault.hashicorp.com/agent-inject-secret-db: postgres/creds/testdb-ro
        vault.hashicorp.com/agent-inject-template-db: |
          {{- with secret "postgres/creds/testdb-ro" }}
          for _ in $(seq 1 50); do echo; done
          date
          set -x
          echo "select * from testdb;"|psql postgresql://{{ .Data.username}}:{{ .Data.password }}@postgres:5432/postgres
          {{ end }}
    spec:
      containers:
        - image: postgres
          imagePullPolicy: IfNotPresent
          name: app
          resources: {}
          command:
            - sh
            - -c
            - |
              echo "waiting for script to become available"
              while true
              do
                test -e /vault/secrets/db && chmod +x /vault/secrets/db && /vault/secrets/db
                sleep 1
              done
      serviceAccountName: demo-app-sa
status: {}