pod-secret.yaml

# Create Namespace
apiVersion: v1
kind: Namespace
metadata:
  name: pod-secret-namespace
---
# Create Source API Secret
apiVersion: v1
kind: Secret
metadata:
  name: source-api-secret
  namespace: pod-secret-namespace
type: Opaque
data:
  API_KEY: bWVnYV9zZWNyZXRfa2V5Cg==
  API_SECRET: cmVhbGx5X3NlY3JldF92YWx1ZTEK
immutable: false
---
# Create DB Login Secret
apiVersion: v1
kind: Secret
metadata:
  name: db-login-secret
  namespace: pod-secret-namespace
type: Opaque
data:
  USERNAME: bWVnYV9zZWXXXXDfa2V5Cg==
  PASSWORD: cmVhbGx5X3NlY3JldF92YWx1ZTEK
immutable: false
---
# Create Tick App Pod
apiVersion: v1
kind: Pod
metadata:
  name: tick-app-pod
  namespace: pod-secret-namespace
  labels:
    name: my-tick-app
spec:
  containers:
    - name: app
      image: alpine
      command: ["sleep", "3600"]
      # Mount DB login secret as env or envFrom
      # Use "env" when you want to mount few keys only as env from secret
      env:
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: db-login-secret     # Secret name
              key: USERNAME             # key name from secret to fetch value from
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-login-secret
              key: PASSWORD
      # Use "envFrom" when you want to mount whole secret as Env
      envFrom:
        - secretRef:
            name: db-login-secret
      # Mount source api secret as volume
      volumeMounts:
        - name: tick-data-app-volume
          mountPath: "/secret"
          readOnly: true
  restartPolicy: Never
  volumes:
    # You create volumes at the Pod level then mount them into containers inside that Pod
    - name: tick-data-app-volume
      secret:
        # Provide the name of the Secret you want to mount
        secretName: source-api-secret