apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth-server
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-cache-enable: "true"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
        vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/systems/auth-system/postgres/auth-server
        vault.hashicorp.com/agent-inject-template-runtime-env: |
          {{ with secret "kv/data/dev/systems/auth-system/postgres/auth-server" }}
          export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.data.APP_DATASOURCE_USERNAME }}
          export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.data.APP_DATASOURCE_PASSWORD }}
          {{ end }}

          {{ with secret "kv/data/dev/workloads/auth-server/keycloak-client" }}
          export APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET }}
          {{ end }}
        vault.hashicorp.com/agent-inject-token: "true"
        vault.hashicorp.com/agent-run-as-group: "10001"
        vault.hashicorp.com/agent-run-as-user: "10001"
        vault.hashicorp.com/role: auth-server-dev
    spec:
      automountServiceAccountToken: false
      volumes:
        - name: vault-token
          projected:
            defaultMode: 0444
            sources:
              - serviceAccountToken:
                  audience: vault
                  expirationSeconds: 3600
                  path: token
      containers:
        - name: auth-server
          command:
            - /bin/sh
            - -ec
          args:
            - |
              . /vault/secrets/runtime-env
              export APP_SECURITY_JWT_VAULT_TOKEN="$(cat /vault/secrets/token)"
              exec java -jar /app/application.jar
          envFrom:
            - configMapRef:
                name: auth-server-config