apiVersion: v1
kind: Pod
metadata:
  name: oidc
spec:
  containers:
    - image: kurun://cmd/examples/main.go
      name: oidc
      volumeMounts:
        - mountPath: /var/run/secrets/tokens
          name: oidc-token
      env:
        - name: KUBERNETES_SERVICE_ACCOUNT_TOKEN
          value: /var/run/secrets/tokens/oidc-token
        - name: VAULT_PATH
          value: jwt
      resources:
        limits:
          cpu: 100m
          memory: 128Mi
        requests:
          cpu: 100m
          memory: 128Mi
  restartPolicy: OnFailure
  serviceAccountName: default
  volumes:
    - name: oidc-token
      projected:
        sources:
          - serviceAccountToken:
              path: oidc-token
              expirationSeconds: 7200
              audience: vault
