# Account reads server.secret from AWS Secrets Manager at startup (PRD #571
# account unification), so each account workload needs the session aws-creds
# mount + AWS_* env.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: account-provider
spec:
  template:
    spec:
      containers:
        - name: account-provider
          env:
            - name: AWS_SHARED_CREDENTIALS_FILE
              value: /var/run/cp9/aws/credentials
            - name: AWS_SDK_LOAD_CONFIG
              value: "1"
            - name: AWS_EC2_METADATA_DISABLED
              value: "true"
            # The account service reads its Secrets Manager startup config and
            # signs org cluster-auth keys through AWS KMS (PRD #571 account
            # unification); region resolution needs these set.
            - name: AWS_REGION
              value: us-west-2
            - name: AWS_DEFAULT_REGION
              value: us-west-2
          volumeMounts:
            - name: aws-creds
              mountPath: /var/run/cp9/aws
              readOnly: true
      volumes:
        - name: aws-creds
          secret:
            secretName: aws-creds
            items:
              - key: creds
                path: credentials