apiVersion: v1
kind: Secret
metadata:
  name: database-secrets
  namespace: default
type: Opaque
data:
  host: bXlzcWwuZXhhbXBsZS5jb20=  # base64 encoded "mysql.example.com"
  port: MzMwNg==  # base64 encoded "3306"
  username: ZGJfdXNlcg==  # base64 encoded "db_user"
  password: ZGJfcGFzcw==  # base64 encoded "db_pass"
---
apiVersion: v1
kind: Secret
metadata:
  name: api-keys
  namespace: default
type: Opaque
data:
  api_key: YWJjZGVmZ2hpams=  # base64 encoded "abcdefghijk"
  secret_key: cXdlcnR5dWlvcA==  # base64 encoded "qwertyuiop"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: complex-app
  namespace: default
  annotations:
    vault-sync.io/path: "secret/data/complex-app"
    vault-sync.io/secrets: |
      [
        {
          "name": "database-secrets",
          "keys": ["host", "port", "username", "password"],
          "prefix": "db_"
        },
        {
          "name": "api-keys",
          "keys": ["api_key", "secret_key"]
        }
      ]
spec:
  replicas: 1
  selector:
    matchLabels:
      app: complex-app
  template:
    metadata:
      labels:
        app: complex-app
    spec:
      containers:
      - name: complex-app
        image: nginx:latest
        ports:
        - containerPort: 80
        env:
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: database-secrets
              key: host
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: database-secrets
              key: username
        - name: API_KEY
          valueFrom:
            secretKeyRef:
              name: api-keys
              key: api_key