pod_level_identity.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: s3-pv
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  storageClassName: "" # Required for static provisioning
  claimRef: # To ensure no other PVCs can claim this PV
    namespace: default # Namespace is required even though it's in "default" namespace.
    name: s3-pvc # Name of your PVC
  mountOptions:
    - allow-delete
    - region us-west-2
  csi:
    driver: s3.csi.aws.com
    volumeHandle: s3-csi-driver-volume
    volumeAttributes:
      bucketName: amzn-s3-demo-bucket
      authenticationSource: pod
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: s3-pvc
spec:
  accessModes:
    - ReadWriteMany # Supported options: ReadWriteMany / ReadOnlyMany
  storageClassName: "" # Required for static provisioning
  resources:
    requests:
      storage: 1Gi
  volumeName: s3-pv # Name of your PV
---
apiVersion: v1
kind: Pod
metadata:
  name: busybox-admin-pod-level
spec:
  serviceAccountName: s3-csi-admin-sa
  containers:
    - name: busybox
      image: busybox
      command: ["sleep", "infinity"]
      volumeMounts:
        - mountPath: "/data"
          name: persistent-storage
  volumes:
    - name: persistent-storage
      persistentVolumeClaim:
        claimName: s3-pvc
---
apiVersion: v1
kind: Pod
metadata:
  name: busybox-read-only-pod-level
spec:
  serviceAccountName: s3-csi-read-only-sa
  containers:
    - name: busybox
      image: busybox
      command: ["sleep", "infinity"]
      volumeMounts:
        - mountPath: "/data"
          name: persistent-storage
  volumes:
    - name: persistent-storage
      persistentVolumeClaim:
        claimName: s3-pvc
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: s3-csi-admin-sa
  labels:
    app.kubernetes.io/name: aws-mountpoint-s3-csi-driver
  annotations:
    eks.amazonaws.com/role-arn: "arn:aws:iam::<user_id>:role/Admin"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: s3-csi-read-only-sa
  annotations:
    eks.amazonaws.com/role-arn: "arn:aws:iam::<user_id>:role/ReadOnly"