apiVersion: batch/v1
kind: Job
metadata:
  name: check-oidc
spec:
  template:
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      containers:
      - name: check-oidc
        image: ko://github.com/mattmoor/kind-oidc/cmd/oidc
        volumeMounts:
        - name: oidc-info
          mountPath: /var/run/kind-oidc

      volumes:
        - name: oidc-info
          projected:
            sources:
              - serviceAccountToken:
                  path: token
                  expirationSeconds: 600 # Use as short-lived as possible.
                  audience: kind-oidc
              - configMap:
                  name: kube-root-ca.crt
                  items:
                  - key: ca.crt
                    path: ca.crt
                    mode: 0666
