apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: taskarr-db-app-user
spec:
  mount: database
  path: creds/taskarr-app
  destination:
    name: taskarr-db-url
    create: true
    # This is where the magic happens
    transformation:
      excludes:
        - .*
      templates:
        DATABASE_URL:
          text: |
            {{- printf "postgresql://%s:%s@postgres-service.taskarr.svc.cluster.local:5432/taskarr?sslmode=disable" (get .Secrets "username") (get .Secrets "password") -}}