apiVersion: apps/v1
kind: Deployment
metadata:
  name: regional-server
spec:
  replicas: 3
  template:
    spec:
      nodeSelector:
        iam.gke.io/gke-metadata-server-enabled: "true"
      tolerations:
        - effect: NoSchedule
          key: iam.gke.io/gke-metadata-server-enabled
          operator: Exists
      containers:
        - name: regional-server
          env:
            - name: AWS_REGION
              value: TMPL_AWS_REGION
            - name: AWS_STS_REGIONAL_ENDPOINTS
              value: regional
            - name: AWS_ROLE_ARN
              value: TMPL_IRSA_ROLE_ARN
            - name: AWS_WEB_IDENTITY_TOKEN_FILE
              value: /var/run/secrets/aws/token
          volumeMounts:
            - name: aws-token
              mountPath: /var/run/secrets/aws
              readOnly: true
      serviceAccountName: dedicated-regional-server-manager
      volumes:
        - name: aws-token
          projected:
            sources:
              - serviceAccountToken:
                  audience: sts.amazonaws.com
                  expirationSeconds: 3600
                  path: token