secret-writer.yml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: secrets-writer-configmap
data:
  entrypoint.sh: |-
    #!/bin/bash
    yum install -y openssh
    export VAULT_TOKEN=$(curl -sk -XPOST -d "{\"jwt\": \"$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\", \"role\": \"secret-writer-role\"}" ${VAULT_ADDR}/v1/auth/kubernetes/login | jq -r '.auth.client_token')
    ssh-keygen -t ed25519 -b 521 -C "philporada@gmail.com" -N"''" -f /root/test_key
    vault kv put kv/ct_key key="$(cat /root/test_key | base64)"
    rm -f test_key
---
apiVersion: v1
kind: Pod
metadata:
  name: secrets-writer-deployment
  labels:
    app: secrets-writer
spec:
  serviceAccount: phil-secret-writer

  volumes:
    - name: configmap-writer-volume
      configMap:
        defaultMode: 0700
        name: secrets-writer-configmap

  restartPolicy: Never
  containers:
    - name: writer
      image: pgporada/vault
      command:
        - /bin/entrypoint.sh
      volumeMounts:
        - name: configmap-writer-volume
          mountPath: /bin/entrypoint.sh
          readOnly: true
          subPath: entrypoint.sh
      env:
        - name: VAULT_ADDR
          value: "http://192.168.1.142:8200"
...