apiVersion: v1
kind: Pod
metadata:
  name: example-just-ca-consumer
spec:
  securityContext:
    fsGroup: 1000
  volumes:
    - name: just-ca
      ephemeral:
        volumeClaimTemplate:
          metadata:
            annotations:
              secrets.stackable.tech/class: just-ca
              # The currently unsupported feature is triggered by explicitly requesting a format
              # and bringing your own ca.crt
              secrets.stackable.tech/format: tls-pkcs12
              # 👇 See here, an actual boolean can not be used here, because of K8s restrictions
              secrets.stackable.tech/tbd: "true"
              # ☝️
          spec:
            storageClassName: secrets.stackable.tech
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: "1"
  containers:
    - name: test
      image: oci.stackable.tech/sdp/testing-tools:0.3.0-stackable0.0.0-dev
      stdin: true
      tty: true
      volumeMounts:
        - name: just-ca
          mountPath: /stackable/tls
---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
metadata:
  name: just-ca
spec:
  backend:
   k8sSearch:
      searchNamespace:
        pod: {}
---
apiVersion: v1
kind: Secret
metadata:
  name: just-ca-secret
  labels:
    secrets.stackable.tech/class: just-ca
stringData:
  ca.crt: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----