Overview

# Export existing resources
cpln gvc get my-gvc --output yaml-slim > gvc.yaml
cpln workload get my-app --gvc my-gvc --output yaml-slim > workload.yaml

# Edit files, then apply
cpln apply --file gvc.yaml
cpln apply --file workload.yaml --gvc my-gvc

# Create a file containing the secret value
echo "hello-world" > my-db-password.txt

# Create an opaque secret from the file
cpln secret create-opaque --name db-password \
  --encoding plain \
  --file my-db-password.txt

# Create a GVC
cpln gvc create --name my-gvc --location aws-us-east-1

# Create an identity for your workload
cpln identity create --name my-app-identity --gvc my-gvc

# Create a policy targeting the secret
cpln policy create --name my-app-secrets-policy \
  --target-kind secret \
  --resource db-password

# Add a binding to grant the identity reveal permission
cpln policy add-binding my-app-secrets-policy \
  --identity //gvc/my-gvc/identity/my-app-identity \
  --permission reveal

# Create a workload with the identity attached and inject the secret as an env var
cpln workload create \
  --name my-app \
  --gvc my-gvc \
  --image nginx:latest \
  --port 80 \
  --identity my-app-identity \
  --env DB_PASSWORD=cpln://secret/db-password.payload \
  --public

# Check workload status (and wait for the workload to become ready)
cpln workload get my-app --gvc my-gvc

# Verify the secret is available in the container
cpln workload exec my-app --gvc my-gvc -- env | grep DB_PASSWORD

# Expected output from the cpln workload exec command
Defaulting to location 'aws-us-east-1' because no location was specified in the command.
Defaulting to replica 'my-app-00001-deployment-6d67547b5d-586d9' because no replica was specified in the command.
Defaulting to container 'nginx' because no container was specified in the command.
DB_PASSWORD=hello-world

# Build and push
cpln image build --name my-app:v1.0.0 --push

# Update workload to use new image (replace <container-name>
# with the acutal container name from your workload)
cpln workload update my-app --gvc my-gvc \
  --set spec.containers.<container-name>.image=//image/my-app:v1.0.0