# Based on the Kubernetes documentation example:
# https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/
#
# Uses two secret volumes:
#   1. "secret-volume" - mounts all keys from "test-secret" at /etc/secret-volume
#      (directly from the K8s docs example pods/inject/secret-pod.yaml)
#   2. "foo" - mounts projected keys from "mysecret" at /etc/foo with defaultMode 0400
#      (from the K8s docs "project keys to specific paths" example)
#
# Secrets must be created before applying this pod:
#   sdme kube secret create test-secret --from-literal username=my-app --from-literal 'password=39528$vdg7Jb'
#   sdme kube secret create mysecret --from-literal username=projuser --from-literal password=projpass
apiVersion: v1
kind: Pod
metadata:
  name: secret-test-pod
spec:
  containers:
    - name: test-container
      image: docker.io/nginx:latest
      volumeMounts:
        # name must match the volume name below
        - name: secret-volume
          mountPath: /etc/secret-volume
          readOnly: true
        - name: foo
          mountPath: /etc/foo
          readOnly: true
  # The secret data is exposed to Containers in the Pod through a Volume.
  volumes:
    - name: secret-volume
      secret:
        secretName: test-secret
    - name: foo
      secret:
        secretName: mysecret
        defaultMode: 0400
        items:
        - key: username
          path: my-group/my-username
