app-job-1-secrets.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: job-sa
  namespace: default
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: job-pod-status
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: job-pod-status
subjects:
  - kind: ServiceAccount
    name: job-sa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: job-pod-status
---
apiVersion: batch/v1
kind: Job
metadata:
  name: app-job
  namespace: default
spec:
  backoffLimit: 1
  template:
    metadata:
      annotations:
        sidecar.vault.talend.org/inject: "true"
        sidecar.vault.talend.org/mode: "job"  # Enable 'job' mode (will also enable 'secrets' mode)
        # Vault Sidecar Injector receive the pod spec: don't know whether it is a job or a deployment. 
        # Annotation below is deprecated, use 'sidecar.vault.talend.org/mode' instead.
        #sidecar.vault.talend.org/workload: "job"
      labels:
        com.talend.application: test
        com.talend.service: test-app-svc
    spec:
      restartPolicy: Never
      # custom serviceAccountName with role allowing to perform GET on pods (needed to poll for job's pod status)
      serviceAccountName: job-sa
      containers:
        - name: app-job-container
          image: busybox:1.28
          command:
            - "sh"
            - "-c"
            - |
              set -e
              while true; do
                echo "Wait for secrets file before running job..."
                if [ -f "/opt/talend/secrets/secrets.properties" ]; then
                  echo "Secrets available"
                  break
                fi
                sleep 2
              done
              echo "Job started"
              echo "I am a job... still working - 1"
              cat /opt/talend/secrets/secrets.properties
              sleep 5
              echo "I am a job... still working - 2"
              cat /opt/talend/secrets/secrets.properties
              sleep 5
              echo "I am a job... still working - 3"
              cat /opt/talend/secrets/secrets.properties
              sleep 5
              echo "I am a job... still working - 4"
              cat /opt/talend/secrets/secrets.properties
              sleep 5
              echo "I am a job... still working - 5"
              cat /opt/talend/secrets/secrets.properties
              echo "Job stopped"