kipunji/kustomize/deployment.yaml

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: toy
  labels:
    app: toy

spec:
  replicas: 3
  selector:
    matchLabels:
      app: toy
  template:
    metadata:
      labels:
        app: toy
    spec:
      containers:
        - name: toy
          image: git.kill0.net/ryanc/toy:latest
          ports:
            - name: web
              containerPort: 4567
          env:
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: toy-session-secret
                  key: toy-session-secret
                  optional: true