deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "sampleapp.fullname" . }}
  labels:
    app: {{ template "sampleapp.name" . }}
    chart: {{ template "sampleapp.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: {{ template "sampleapp.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
        app: {{ template "sampleapp.name" . }}
        release: {{ .Release.Name }}
    spec:
      volumes:
        - name: secrets-mount
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "azure-keyvault"
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: {{ .Values.service.port }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 30
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 30
          env:
            - name: APPINSIGHTS_INSTRUMENTATIONKEY
              value: {{ .Values.applicationInsights.InstrumentationKey }}
            {{- $root := . }}
            {{- range $ref, $values := .Values.secrets }}
            {{- range $key, $value := $values }}
            - name: {{ $ref | upper }}_{{ $key | upper }}
              valueFrom:
                secretKeyRef:
                  name: {{ template "sampleapp.fullname" $root }}-{{ $ref }}
                  key: {{ $key }}
            {{- end }}
            {{- end }}
          volumeMounts:
          # This mount is not used by the application but is required for the secretProviderClass
            - mountPath: "mnt/secrets-store"
              name: secrets-mount
              readOnly: true
          resources:
{{ toYaml .Values.resources | indent 12 }}
    {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- range .Values.imagePullSecrets }}
        - name: {{ . }}
      {{- end}}
    {{- end }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}