extraVolumes:
  - name: oidc-token
    projected:
      sources:
      - serviceAccountToken:
          path: oidc-token
          expirationSeconds: 7200    # The validity period of the OIDC token in seconds.
          audience: "sts.aliyuncs.com"

extraVolumeMounts:
  - name: oidc-token
    mountPath: /var/run/secrets/tokens