apiVersion: v1
kind: Pod
metadata:
  annotations:
    sidecar.istio.io/inject: "false"
  name: kubeflow-secrets-pod
  namespace: kubeflow
spec:
  containers:
  - image: public.ecr.aws/xray/aws-xray-daemon:latest
    name: secrets
    volumeMounts:
    - mountPath: /mnt/rds-store
      name: rds-secret
      readOnly: true
    - mountPath: /mnt/aws-store
      name: s3-secret
      readOnly: true
  serviceAccountName: kubeflow-secrets-manager-sa
  volumes:
  - csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: aws-secrets
    name: rds-secret
  - csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: aws-secrets
    name: s3-secret
