Podman secrets in pod manifests

unifi.yaml

apiVersion: v1
kind: Pod
metadata:
  labels:
    app: unifi-pod
  name: unifi-pod
spec:
  hostNetwork: true
  containers:
  - name: unifi-db
    image: docker.io/library/mongo:7
    env:
    - name: TZ
      value: Etc/UTC
    - name: MONGO_INITDB_ROOT_USERNAME
      value: admin
    - name: MONGO_INITDB_ROOT_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mongodb-secret
          key: mongopw
    volumeMounts:
    - name: mongodb-init
      mountPath: /docker-entrypoint-initdb.d/
      readOnly: true
    - name: unifi-mongo-pvc
      mountPath: /data/db
  - name: unifi
    image: lscr.io/linuxserver/unifi-network-application:latest
    env:
    - name: MONGO_USER
      value: unifi
    - name: MONGO_PASS
      valueFrom:
        secretKeyRef:
          name: unifi-mongo-secret
          key: unifi-mongo-pw
    - name: MEM_STARTUP
      value: "1024"
    - name: MONGO_PORT
      value: "27017"
    - name: MEM_LIMIT
      value: "1024"
    - name: PUID
      value: "1000"
    - name: PGID
      value: "1000"
    - name: MONGO_HOST
      value: unifi-db
    - name: MONGO_DBNAME
      value: unifi
    - name: TZ
      value: Etc/UTC
    volumeMounts:
    - mountPath: /config
      name: unifi-network-application-pvc
  volumes:
  - name: mongodb-init
    configMap:
      name: mongo_init
  - name: unifi-mongo-pvc
    persistentVolumeClaim:
      claimName: unifi-mongo
  - name: unifi-network-application-pvc
    persistentVolumeClaim:
      claimName: unifi-network-application
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: unifi-mongo
  labels:
    app: unifi-pod
spec:
  accessModes:
    - ReadWriteOnce
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: unifi-network-application
  labels:
    app: unifi-pod
spec:
  accessModes:
    - ReadWriteOnce
---
apiVersion: v1
kind: Secret
metadata:
  name: mongodb-secret
data:
  mongopw: QnpNRTJBZG1QRks3YkRlME55M1d5M3A1aDJmWnIwVEIK
---
apiVersion: v1
kind: Secret
metadata:
  name: unifi-mongo-secret
data:
  unifi-mongo-pw: dWFYY0FuMHp0MWFVWWRhM2pjZU41Y0t1WlY5Y0NHaXoK
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mongo_init
data:
  init-mongo.js: |
    db.getSiblingDB('admin').auth(
             process.env.MONGO_INITDB_ROOT_USERNAME,
             process.env.MONGO_INITDB_ROOT_PASSWORD
         );
         disableTelemetry();
         db.getSiblingDB("unifi").createUser({
              user: "unifi",
              pwd: "EKoElzGCAwLtcl3NBwlQJHABYjx4Eac8",
              roles: [
                  {
                      db: "unifi",
                      role: "dbOwner"
                  },
                  {
                      db: "unifi_stat",
                      role: "dbOwner"
                  }
              ]
          });