test-deploy-ct.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: consul-template-pki
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: consul-template-pki
  template:
    metadata:
      labels:
        app.kubernetes.io/name: consul-template-pki
      annotations:
        vault.security.banzaicloud.io/vault-addr: "https://vault:8200"
        vault.security.banzaicloud.io/vault-tls-secret: vault-tls
        vault.security.banzaicloud.io/vault-ct-configmap: consul-template-pki
    spec:
      containers:
      - name: alpine
        image: alpine
        command: ["sh", "-c", "apk add openssl; while true; do openssl x509 -text -noout -in /vault/secrets/my-server.crt; echo; sleep 5; done"]
        resources:
          limits:
            memory: "128Mi"
            cpu: "100m"

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: consul-template-pki
  labels:
    app.kubernetes.io/name: consul-template-pki
data:
  config.hcl: |
    vault {
      ssl {
        ca_cert = "/vault/tls/ca.crt"
      }
      retry {
        backoff = "1s"
      }
    }
    template {
      contents = <<EOH
      {{- with secret "pki/issue/default" "common_name=localhost" -}}
      {{ .Data.certificate }}{{- end -}}
      EOH
      destination = "/vault/secrets/my-server.crt"
    }