mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-08-30 23:37:45 +00:00
1c2d69ded7
The sealed secret test depends on the KBS to provide the unsealed value of a vault secret. This secret is provisioned to an environment variable. Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
37 lines
764 B
YAML
37 lines
764 B
YAML
# Copyright (c) 2023 Intel Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: secret-test-pod-cc
|
|
spec:
|
|
runtimeClassName: kata
|
|
containers:
|
|
- name: busybox
|
|
image: quay.io/prometheus/busybox:latest
|
|
imagePullPolicy: Always
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
env
|
|
echo "PROTECTED_SECRET = $PROTECTED_SECRET"
|
|
echo "UNPROTECTED_SECRET = $UNPROTECTED_SECRET"
|
|
sleep 1000
|
|
|
|
# Expose secret data Containers through environment.
|
|
env:
|
|
- name: PROTECTED_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sealed-secret
|
|
key: secret
|
|
- name: UNPROTECTED_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: not-sealed-secret
|
|
key: secret
|
|
|