vault-secrets-minio.yaml

## Create headless service to StatefulSet to work.
apiVersion: v1
kind: Service
metadata:
  name: minio-headless
  labels:
    app: minio-headless
spec:
  ports:
  - port: 9000
  clusterIP: None
  selector:
    app: minio
---
apiVersion: apps/v1 #  for k8s versions before 1.9.0 use apps/v1beta2  and before 1.8.0 use extensions/v1beta1
kind: StatefulSet
metadata:
  name: minio
  labels:
     app: minio
spec:
  selector:
    matchLabels:
      app: minio
  serviceName: "minio-headless"
  replicas: 4
  selector:
    matchLabels:
      app: minio
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-secret-minio-secrets: "internal/data/minio/config"
        vault.hashicorp.com/role: "minio-app"
        vault.hashicorp.com/agent-inject-template-minio-secrets: |
          {{- with secret "internal/data/minio/config" -}}
             export MINIO_ROOT_USER="{{ .Data.data.access_key }}"
             export MINIO_ROOT_PASSWORD="{{ .Data.data.secret_key }}"
          {{- end -}}
      labels:
        app: minio
    spec:
      serviceAccountName: minio-app
      containers:
      - name: minio
        image: minio/minio:RELEASE.2020-06-14T18-32-17Z
        command: [
        "/bin/sh",
        "-ce",
        "source /vault/secrets/minio-secrets && /usr/bin/docker-entrypoint.sh server http://minio-{0...3}.minio-headless.default.svc.cluster.local/data" ]
        ports:
        - containerPort: 9000
          hostPort: 9000