apiVersion: apps/v1
kind: Deployment
metadata:
  name: production-app
  namespace: default
  annotations:
    # Enable sync to Vault
    vault-sync.io/path: "secret/data/production-app"
    
    # IMPORTANT: Preserve secrets in Vault when this deployment is deleted
    # This is useful for production secrets that should persist beyond deployment lifecycle
    vault-sync.io/preserve-on-delete: "true"
    
    # Custom secret configuration
    vault-sync.io/secrets: |
      [
        {
          "name": "database-credentials",
          "keys": ["username", "password", "host"],
          "prefix": "db_"
        },
        {
          "name": "api-keys",
          "keys": ["api_token", "webhook_secret"],
          "prefix": "api_"
        }
      ]
spec:
  replicas: 3
  selector:
    matchLabels:
      app: production-app
  template:
    metadata:
      labels:
        app: production-app
    spec:
      containers:
      - name: app
        image: myapp:latest
        env:
        # Database configuration
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: database-credentials
              key: username
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: database-credentials
              key: password
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: database-credentials
              key: host
        # API configuration
        - name: API_TOKEN
          valueFrom:
            secretKeyRef:
              name: api-keys
              key: api_token
        - name: WEBHOOK_SECRET
          valueFrom:
            secretKeyRef:
              name: api-keys
              key: webhook_secret

---
# Database credentials secret
apiVersion: v1
kind: Secret
metadata:
  name: database-credentials
  namespace: default
type: Opaque
data:
  username: bXlkYnVzZXI=      # mydbuser
  password: c3VwZXJzZWNyZXQ=  # supersecret
  host: ZGIuZXhhbXBsZS5jb20=  # db.example.com

---
# API keys secret
apiVersion: v1
kind: Secret
metadata:
  name: api-keys
  namespace: default
type: Opaque
data:
  api_token: YWJjZGVmZ2hpams=         # abcdefghijk
  webhook_secret: d2ViaG9va3NlY3JldA== # webhooksecret

---
# Example of what gets stored in Vault:
# Path: secret/data/production-app
# {
#   "data": {
#     "db_username": "mydbuser",
#     "db_password": "supersecret", 
#     "db_host": "db.example.com",
#     "api_api_token": "abcdefghijk",
#     "api_webhook_secret": "webhooksecret"
#   }
# }
#
# When this deployment is deleted:
# - The finalizer will run
# - Due to vault-sync.io/preserve-on-delete: "true", the Vault secret will NOT be deleted
# - The secrets will remain in Vault for other applications or manual cleanup