apiVersion: v1
kind: Namespace
metadata:
  name: billing
---
apiVersion: v1
kind: Secret
metadata:
  name: billing-credentials
  namespace: billing
type: Opaque
stringData:
  api-key: test-key
  legacy-password: do-not-mount
---
apiVersion: v1
kind: Pod
metadata:
  name: reconciler
  namespace: billing
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsUser: 1000
    seccompProfile:
      type: RuntimeDefault
  volumes:
  - name: api-key
    secret:
      secretName: billing-credentials
      items: 
      - key: api-key
        path: api-key
  - name: temp
    emptyDir: {}
  containers:
  - name: billing-container
    image: busybox:1.37
    command: ["sh","-c","sleep 3600"]
    securityContext:
      readOnlyRootFilesystem: true 
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
    volumeMounts:
    - name: api-key
      readOnly: true
      mountPath: /var/run/credentials
    - name: temp
      mountPath: /tmp
    resources: 
      requests:
        cpu: "100m"
        memory: 128Mi
      limits:
        cpu: "100m"
        memory: 128Mi