workload.yaml

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: workload-certificate
  namespace: default
spec:
  secretName: workload-tls
  subject:
    organizations:
      - Example Organization
  dnsNames:
    - workload.demo.example.com
  issuerRef:
    name: venafi-tpp-issuer
    kind: Issuer
---
apiVersion:  apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-workload
  name: nginx-workload-deployment
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-workload
  template:
    metadata:
      labels:
        app: nginx-workload
    spec:
      containers:
        - image: nginx:1.9.11
          name: nginx-workload
          volumeMounts:
            - mountPath: "/etc/nginx/ssl"
              name: workload-tls
              readOnly: true
            - mountPath: "/etc/nginx/conf.d"
              name: workload-config
              readOnly: true
          ports:
            - containerPort: 443
              hostPort: 4430
              name: https
      volumes:
        - name: workload-tls
          secret:
            secretName: workload-tls
        - name: workload-config
          configMap:
            name: nginx-workload-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-workload-config
  namespace: default
data:
  default.conf: |
   server {
       listen       443 ssl default_server;
       server_name  workload.demo.cert-manager.io;

       ssl_certificate     /etc/nginx/ssl/tls.crt;
       ssl_certificate_key /etc/nginx/ssl/tls.key;

       location / {
           root   /usr/share/nginx/html;
           index  index.html index.htm;
       }

       error_page   500 502 503 504  /50x.html;
       location = /50x.html {
           root   /usr/share/nginx/html;
       }
   }
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-workload-service
  namespace: default
spec:
  type: NodePort
  ports:
    - name: https
      port: 4430
      protocol: TCP
      targetPort: 4430
  selector:
    app: nginx-workload