apiVersion: v1
kind: Pod
metadata:
  name: demo-standalone
  annotations:
    piggysec.com/standalone: "true"
    piggysec.com/aws-secret-name: demo/sample/test
    piggysec.com/aws-region: ap-southeast-1
spec:
  serviceAccountName: demo-standalone
  securityContext:
    fsGroup: 1337
  containers:
    - image: ghcr.io/kongz/piggy-demo:latest
      name: demo
      env:
        - name: TEST_ENV
          value: piggy:TEST_ENV
        - name: AWS_ROLE_ARN
          value: ${your-role-arn}
        - name: AWS_WEB_IDENTITY_TOKEN_FILE
          value: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
      resources:
        limits:
          memory: "64Mi"
          cpu: "200m"
      volumeMounts:
        - mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount
          name: aws-iam-token
          readOnly: true
  volumes:
    - name: aws-iam-token
      projected:
        defaultMode: 420
        sources:
        - serviceAccountToken:
            audience: sts.amazonaws.com
            expirationSeconds: 86400
            path: token