apiVersion: v1
kind: Pod
metadata:
  name: secrets-manager-secret-credentials
  # setup.sh fills in the namespace, the image, the Region, the secret and the key ARN at
  # apply time.
  labels:
    # Deliberately not app: secrets-manager-secret, which is the sandbox's own label. This
    # pod is not the sandbox, and its own label keeps the two apart in the logs.
    app: secrets-manager-secret-credentials
    app.kubernetes.io/name: secrets-manager-secret-credentials
    app.kubernetes.io/managed-by: secrets-manager-secret
spec:
  # No runtimeClassName: an ordinary pod. It stands for anyone who holds the pod's AWS
  # credentials without being the attested sandbox, which in confidential mode includes the
  # node itself: the parent instance can obtain the same Pod Identity credentials the
  # workload uses, either by reading them as they are delivered or by minting them from the
  # kubelet's own credentials and the node role (Amazon EKS User Guide, "Security model and
  # parent instance trust assumptions").
  #
  # It uses the SAME service account as the sandboxed pod, so EKS Pod Identity hands it the
  # SAME IAM role, and it runs the SAME image, importing the workload's own envelope
  # reader. The only thing it does not have is an attestation document.
  serviceAccountName: secrets-manager-secret-pod
  restartPolicy: Never
  automountServiceAccountToken: false
  enableServiceLinks: false
  terminationGracePeriodSeconds: 0
  securityContext:
    runAsUser: 65534
    runAsGroup: 65534
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: main
      image: <APP_IMAGE_URI>
      imagePullPolicy: IfNotPresent
      command: ["python", "/app/no_attestation.py"]
      env:
        - name: AWS_REGION
          value: <AWS_REGION>
        - name: AWS_DEFAULT_REGION
          value: <AWS_REGION>
        - name: SECRET_ID
          value: <SECRET_ID>
        - name: KMS_KEY_ARN
          value: <KMS_KEY_ARN>
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      resources:
        requests:
          cpu: 100m
          memory: 256Mi