sia.yaml

spec:
  template:
    spec:
      containers:
      - args:
        - --mode=refresh
        image: local/athenz-sia:latest
        imagePullPolicy: IfNotPresent
        name: sia
        volumeMounts:
        - mountPath: /var/run/athenz
          name: tls-certs
        - mountPath: /var/run/secrets/kubernetes.io/bound-serviceaccount
          name: identityd-token
          readOnly: true
      initContainers:
      - args:
        - --mode=init
        image: local/athenz-sia:latest
        imagePullPolicy: IfNotPresent
        name: sia-init
        volumeMounts:
        - mountPath: /var/run/athenz
          name: tls-certs
        - mountPath: /var/run/secrets/kubernetes.io/bound-serviceaccount
          name: identityd-token
          readOnly: true
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_UID
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.uid
        - name: SERVICEACCOUNT
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.serviceAccountName
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
      volumes:
      - emptyDir: {}
        name: tls-certs
      - name: identityd-token
        projected:
          sources:
          - serviceAccountToken:
              audience: athenz-identityd
              expirationSeconds: 3600
              path: token