✅ Kubernetes Secret-provider to env variables

apiVersion: apps/v1
kind: Deployment
metadata:
  name: service-login-deployment
  namespace: brewingstand
spec:
  replicas: 1
  selector:
    matchLabels:
      app: service-login
  template:
    metadata:
      labels:
        app: service-login
    spec:
      containers:
        - name: service-login
          image: ghcr.io/brewing-stand/service-login:master
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "500m"
          volumeMounts:
            - name: secrets-store
              mountPath: "/mnt/secrets-store"
              readOnly: true
      volumes:
        - name: secrets-store
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "brewing-secretsprovider"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: service-login-deployment
  namespace: brewingstand
spec:
  replicas: 1
  selector:
    matchLabels:
      app: service-login
  template:
    metadata:
      labels:
        app: service-login
    spec:
      containers:
        - name: service-login
          image: ghcr.io/brewing-stand/service-login:master
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "500m"
          volumeMounts:
            - name: secrets-store
              mountPath: "/mnt/secrets-store"
              readOnly: true
      volumes:
        - name: secrets-store
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "brewing-secretsprovider"

# This is a SecretProviderClass example using user-assigned identity to access your key vault
# Service Connector sets up the Azure resource connection, users only need create the SecretProviderClass and workload resources
# For the variables to fill in, you may get their values from Service Connector Azure Portal


apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name:  brewing-secretsprovider
  namespace: brewingstand
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"                        # Set to true for using managed identity
    userAssignedIdentityID: MyId   # Set the clientID of the user-assigned managed identity to use
    keyvaultName: brewingKeys               # Set to the name of your key vault
    objects:  |                             # Secrets in Azure Key Vault
      array: 
        - |
          objectName: appsettings-allowedorigins      
          objectType: secret
        - |
          objectName: connectionstrings-azureblobstorage
          objectType: secret
        - |
          objectName: connectionstrings-postgresql-db
          objectType: secret
        - |
          objectName: gitsecrets-client
          objectType: secret
        - |
          objectName: gitsecrets-secret
          objectType: secret
        - |
          objectName: jwtsettings-secretkey
          objectType: secret
        - |
          objectName: logging-loglevel-default
          objectType: secret
        - |
          objectName: logging-loglevel-microsoftaspnetcore
          objectType: secret
    tenantId: myId             # The tenant ID of the key vault

# This is a SecretProviderClass example using user-assigned identity to access your key vault
# Service Connector sets up the Azure resource connection, users only need create the SecretProviderClass and workload resources
# For the variables to fill in, you may get their values from Service Connector Azure Portal


apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name:  brewing-secretsprovider
  namespace: brewingstand
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"                        # Set to true for using managed identity
    userAssignedIdentityID: MyId   # Set the clientID of the user-assigned managed identity to use
    keyvaultName: brewingKeys               # Set to the name of your key vault
    objects:  |                             # Secrets in Azure Key Vault
      array: 
        - |
          objectName: appsettings-allowedorigins      
          objectType: secret
        - |
          objectName: connectionstrings-azureblobstorage
          objectType: secret
        - |
          objectName: connectionstrings-postgresql-db
          objectType: secret
        - |
          objectName: gitsecrets-client
          objectType: secret
        - |
          objectName: gitsecrets-secret
          objectType: secret
        - |
          objectName: jwtsettings-secretkey
          objectType: secret
        - |
          objectName: logging-loglevel-default
          objectType: secret
        - |
          objectName: logging-loglevel-microsoftaspnetcore
          objectType: secret
    tenantId: myId             # The tenant ID of the key vault