test-deploy-va.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault-agent-pki
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vault-agent-pki
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault-agent-pki
      annotations:
        vault.security.banzaicloud.io/vault-addr: "https://vault:8200"
        vault.security.banzaicloud.io/vault-tls-secret: vault-tls
        vault.security.banzaicloud.io/vault-agent-configmap: vault-agent-pki
    spec:
      containers:
      - name: alpine
        image: alpine
        command: ["sh", "-c", "apk add openssl; while true; do openssl x509 -text -noout -in /vault/secrets/my-server.crt; echo; sleep 5; done"]
        resources:
          limits:
            memory: "128Mi"
            cpu: "100m"

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: vault-agent-pki
  labels:
    app.kubernetes.io/name: vault-agent-pki
data:
  config.hcl: |
    auto_auth {
      method "kubernetes" {
        mount_path = "auth/kubernetes"
        config = {
          role = "default"
        }
      }
      sink "file" {
        config = {
          path = "/vault/.vault-token"
        }
      }
    }
    template {
      contents = <<EOH
      {{- with secret "pki/issue/default" "common_name=localhost" -}}
      {{ .Data.certificate }}{{- end -}}
      EOH
      destination = "/vault/secrets/my-server.crt"
    }