deployment_with_role.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-aws-iam-controller
  namespace: kube-system
  labels:
    application: kube-aws-iam-controller
    version: latest
spec:
  replicas: 1
  selector:
    matchLabels:
      application: kube-aws-iam-controller
  template:
    metadata:
      labels:
        application: kube-aws-iam-controller
        version: latest
    spec:
      serviceAccountName: kube-aws-iam-controller
      containers:
      - name: kube-aws-iam-controller
        image: registry.opensource.zalan.do/teapot/kube-aws-iam-controller:latest
        env:
        # must be set for the AWS SDK/AWS CLI to find the credentials file.
        - name: AWS_SHARED_CREDENTIALS_FILE
          value: /meta/aws-iam/credentials
        volumeMounts:
        - name: aws-iam-credentials
          mountPath: /meta/aws-iam
          readOnly: true
        resources:
          limits:
            cpu: 25m
            memory: 100Mi
          requests:
            cpu: 25m
            memory: 100Mi
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          failureThreshold: 5
          initialDelaySecond: 10
          periodSeconds: 10
      volumes:
      - name: aws-iam-credentials
        secret:
          secretName: kube-aws-iam-controller-iam-role # name of the AWSIAMRole resource
---
apiVersion: zalando.org/v1
kind: AWSIAMRole
metadata:
  name: kube-aws-iam-controller-iam-role
spec:
  roleReference: <arn-of-the-iam-role> # AWS IAM role name or full ARN