diff --git a/examples/providerconfig/v1beta1/pod-identity.yaml b/examples/providerconfig/v1beta1/pod-identity.yaml new file mode 100644 index 0000000000..0f96c40d97 --- /dev/null +++ b/examples/providerconfig/v1beta1/pod-identity.yaml @@ -0,0 +1,54 @@ +# SPDX-FileCopyrightText: 2024 The Crossplane Authors +# +# SPDX-License-Identifier: CC0-1.0 + +apiVersion: aws.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: pod-identity +spec: + credentials: + source: WebIdentity + webIdentity: + roleARN: arn:aws:iam::123456789012:role/pod-identity-role + tokenConfig: + fs: + path: /var/run/secrets/pods.eks.amazonaws.com/serviceaccount/eks-pod-identity-token + source: Filesystem +--- +apiVersion: iam.aws.upbound.io/v1beta1 +kind: OpenIDConnectProvider +metadata: + name: pod-identity +spec: + forProvider: + clientIdList: + - pods.eks.amazonaws.com + thumbprintList: + - 9e99a48a9960b14926bb7f3b02e22da2b0ab7280 + url: oidc.eks..amazonaws.com/id/ +--- +apiVersion: iam.aws.upbound.io/v1beta1 +kind: Role +metadata: + name: pod-identity-role + labels: + testing.upbound.io/example-name: pod-identity +spec: + forProvider: + assumeRolePolicy: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "pods.eks.amazonaws.com" + }, + "Action": [ + "sts:AssumeRole", + "sts:TagSession" + ] + } + ] + }