apiVersion: apps/v1
kind: Deployment
metadata:
  name: aws-provider-upstream
spec:
  template:
    spec:
      serviceAccountName: aws-provider-upstream
      containers:
        - name: aws-provider-upstream
          env:
            - name: AWS_REGION
              value: us-west-2
            - name: AWS_STS_REGIONAL_ENDPOINTS
              value: regional
            - name: AWS_ROLE_ARN
              value: TMPL_IRSA_ROLE_ARN
            - name: AWS_WEB_IDENTITY_TOKEN_FILE
              value: /var/run/secrets/aws/token
          volumeMounts:
            - name: aws-token
              mountPath: /var/run/secrets/aws
              readOnly: true
      volumes:
        - name: aws-token
          projected:
            sources:
              - serviceAccountToken:
                  audience: sts.amazonaws.com
                  expirationSeconds: 3600
                  path: token