apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    sidecar.istio.io/inject: "false"
  name: aws-secrets-sync
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: aws-secrets-sync
  template:
    metadata:
      labels:
        app: aws-secrets-sync
    spec:
      containers:
      - image: public.ecr.aws/xray/aws-xray-daemon:latest
        name: secrets
        volumeMounts:
        - mountPath: /mnt/s3-store
          name: s3-secret
          readOnly: true
      serviceAccountName: kubeflow-secrets-manager-sa
      volumes:
      - csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: s3-secret
        name: s3-secret
