pod.yaml

---
apiVersion: v1
kind: Pod
metadata:
  name: asm-sample-pod
  labels:
    name: asm-sample-pod
    asm-webhook: "true"
  annotations:
    asm.webhook.debug: "true"
spec:
  serviceAccountName: webserver-service-account # account mapped to a role that can fetch a secret in KEY_ID env var
  containers:
  - name: asm-sample-pod
    image: alpine
    command:
      - /bin/sh
    args:
      - -c
      - trap "exit" TERM; while :; do sleep 1; echo decrypted value $KEY_ID; done
    env:
    - name: KEY_ID
      value: <secretsmanager_arn> # ARN of a secret