apiVersion: secrets.hashicorp.com/v1beta1
kind: HCPDynamicSecret
metadata:
  name: taskarr-db-app-user
spec:
  mount: database
  path: creds/taskarr-role
  method: GET
  destination:
    name: taskarr-db-url
    create: true
    # This is where the magic happens
    transformation:
      templates:
        DATABASE_URL:
          # Use Go template syntax to build the string
          # 'username' and 'password' come from the Vault response
          content: "postgresql://{{ .username }}:{{ .password }}@postgres-service.taskarr.svc.cluster.local:5432/taskarr_db?sslmode=disable"
  refreshAfter: 1h