---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: iamserviceaccount-checker
  labels:
    app: iamserviceaccount-checker
spec:
  replicas: 2
  selector:
    matchLabels:
      app: iamserviceaccount-checker
  template:
    metadata:
      labels:
        app: iamserviceaccount-checker
    spec:
      serviceAccountName: s3-reader
      # use a shared volume
      volumes: [{name: aws-credentials, emptyDir: {}}]
      initContainers:
        - name: assume-role
          image: atlassian/pipelines-awscli:1.16.185  
          volumeMounts: [{name: aws-credentials, mountPath: /etc/aws}]
          command:
          - sh
          - -c
          # we don't want to run the command in the loop to avoid hitting STS API rate limits;
          # hence we generate a session file and write it to the shared volume
          - aws sts assume-role-with-web-identity --role-arn $AWS_ROLE_ARN --web-identity-token file://$AWS_WEB_IDENTITY_TOKEN_FILE --role-session-name integration-test --duration-seconds 900 > /etc/aws/session.json
      containers:
      - name: podinfod
        image: stefanprodan/podinfo:1.5.1@sha256:702633d438950f3675d0763a4ca6cfcf21a4d065cd7f470446c67607b1a26750
        volumeMounts: [{name: aws-credentials, mountPath: /etc/aws}]
        command:
        - sh
        - -c
        # read session file from the shared volume and store in as environment variable,
        # the test suite will make a GET request on /env and inspect this and other environment variables
        - export AWS_SESSION_OBJECT="$(cat /etc/aws/session.json)"; ./podinfo --port=8080
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: 1
          periodSeconds: 5
          failureThreshold: 1
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 1
          periodSeconds: 10
          failureThreshold: 2
        resources:
          requests:
            memory: "32Mi"
            cpu: "10m"
