---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  namespace: kube-system
  name: aws-iam-authenticator
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  labels:
    k8s-app: aws-iam-authenticator
spec:
  revisionHistoryLimit: 10
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      k8s-app: aws-iam-authenticator
  template:
    metadata:
      labels:
        k8s-app: aws-iam-authenticator
    spec:
      # use service account with access to
      serviceAccountName: aws-iam-authenticator

      # run on the host network (don't depend on CNI)
      hostNetwork: true

      # run on each master node
      nodeSelector:
        node.kubernetes.io/role: master
      tolerations:
        - effect: NoSchedule
          key: node.kubernetes.io/role
          operator: Equal
          value: master
        - key: CriticalAddonsOnly
          operator: Exists

      priorityClassName: system-cluster-critical

      # run `aws-iam-authenticator server` with three volumes
      # - config (mounted from the ConfigMap at /etc/aws-iam-authenticator/config.yaml)
      # - state (persisted TLS certificate and keys, mounted from the host)
      # - output (output kubeconfig to plug into your apiserver configuration, mounted from the host)
      containers:
        - name: aws-iam-authenticator
          image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-iam-authenticator:v0.5.1-alpine-3.7
          args:
            - server
            - --config=/etc/aws-iam-authenticator/config.yaml
            - --state-dir=/var/aws-iam-authenticator
            - --kubeconfig-pregenerated=true
          resources:
            requests:
              memory: 20Mi
              cpu: 10m
            limits:
              memory: 20Mi
              cpu: 100m
          volumeMounts:
            - name: config
              mountPath: /etc/aws-iam-authenticator/
            - name: state
              mountPath: /var/aws-iam-authenticator/
            - name: output
              mountPath: /etc/kubernetes/aws-iam-authenticator/
      volumes:
        - name: config
          configMap:
            name: aws-iam-authenticator
        - name: output
          hostPath:
            path: /srv/kubernetes/aws-iam-authenticator/
        - name: state
          hostPath:
            path: /srv/kubernetes/aws-iam-authenticator/
