Seal a secret.
Deploy it.
Watch one pod open it.

# Workload-scoped API key from Portal — scope keys:lookup:workload, bound to the workload
$ export ASTIS_API_KEY="astis_live_sk_…"

# seal the DB password  (-y: required when piped · tr: strip astis-cli's trailing newline)
$ vault kv get -field=pwd secret/hr-portal \
    | astis-cli -y --secret-id db-password \
    | tr -d '\n' > sealed.txt

# astis-cli writes the resolved params to stderr; the pure envelope → sealed.txt:
Resolved encrypt parameters:
  alg:              HPKE-X25519-CHACHA20POLY1305 (ASTIS:v2)
  cluster_id:       gs-demo-eu1
  namespace:        hr-portal-demo
  serviceaccount:   sdk-exec
  secret_id:        db-password
  kek_fingerprint:  b0a858e3…

$ cat sealed.txt
ASTIS:v2:eyJhbGciOiJIUEtFLVgyNTUxOS1IS0RG…

# idempotent: create-or-update the Secret holding the (newline-free) envelope
$ kubectl create secret generic hr-portal-db \
    --from-file=DB_PASSWORD=sealed.txt -n hr-portal-demo \
    --dry-run=client -o yaml | kubectl apply -f -

# pod spec (excerpt) — env exposes the envelope; astis-exec unseals it in RAM, then runs your app
spec:
  serviceAccountName: sdk-exec
  containers:
  - name: hr-portal
    command: ["astis-exec", "--fork", "--", "./hr-portal"]
    env:
    - name: DB_PASSWORD                  # astis-exec unseals any ASTIS:v2: env value
      valueFrom: { secretKeyRef: { name: hr-portal-db, key: DB_PASSWORD } }
    volumeMounts:
    - { name: astis-key,   mountPath: /etc/astis, readOnly: true }
    - { name: astis-token, mountPath: /var/run/secrets/astis-audience, readOnly: true }
  volumes:
  - name: astis-key
    secret: { secretName: sdk-exec-api-key, items: [{ key: api-key, path: api-key }] }
  - name: astis-token
    projected: { sources: [{ serviceAccountToken: { audience: astis.io, path: token } }] }

$ kubectl logs deploy/astis-exec-demo -n hr-portal-demo
[astis-exec] unsealed DB_PASSWORD (sha256=0e965c33ba2d, 8 bytes)
[astis-exec] unsealed DB_USER (sha256=4e16a8e4f4e9, 10 bytes)
[astis-exec] fork /usr/bin/sh pid=2663 — astis-exec stays PID 1 (supervise, signal-forward, reap)
[app] DB_USER len=10
[app] DB_PASSWORD len=8   # plaintext only in this pod's RAM — the app never knew it was sealed
[app] unmodified app, ASTIS-unaware

# at rest the Secret data is still the sealed envelope (default get hides data — decode it):
$ kubectl get secret sdk-exec-db-password -n hr-portal-demo -o jsonpath='{.data.envelope}' | base64 -d
ASTIS:v2:eyJhbGciOiJIUEtF…