"use strict";var _a;Object.defineProperty(exports,"__esModule",{value:!0}),exports.ServiceAccount=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),aws_iam_1=require("../../aws-iam"),core_1=require("../../core"),constructs_1=require("constructs"),k8s_manifest_1=require("./k8s-manifest");class ServiceAccount extends constructs_1.Construct{constructor(scope,id,props){var _b,_c;super(scope,id);jsiiDeprecationWarnings.aws_cdk_lib_aws_eks_ServiceAccountProps(props);const{cluster}=props;this.serviceAccountName=(_b=props.name)!==null&&_b!==void 0?_b:core_1.Names.uniqueId(this).toLowerCase(),this.serviceAccountNamespace=(_c=props.namespace)!==null&&_c!==void 0?_c:"default";const conditions=new core_1.CfnJson(this,"ConditionJson",{value:{[`${cluster.openIdConnectProvider.openIdConnectProviderIssuer}:aud`]:"sts.amazonaws.com",[`${cluster.openIdConnectProvider.openIdConnectProviderIssuer}:sub`]:`system:serviceaccount:${this.serviceAccountNamespace}:${this.serviceAccountName}`}}),principal=new aws_iam_1.OpenIdConnectPrincipal(cluster.openIdConnectProvider).withConditions({StringEquals:conditions});this.role=new aws_iam_1.Role(this,"Role",{assumedBy:principal}),this.assumeRoleAction=this.role.assumeRoleAction,this.grantPrincipal=this.role.grantPrincipal,this.policyFragment=this.role.policyFragment,new k8s_manifest_1.KubernetesManifest(this,`manifest-${id}ServiceAccountResource`,{cluster,manifest:[{apiVersion:"v1",kind:"ServiceAccount",metadata:{name:this.serviceAccountName,namespace:this.serviceAccountNamespace,labels:{"app.kubernetes.io/name":this.serviceAccountName},annotations:{"eks.amazonaws.com/role-arn":this.role.roleArn}}}]})}addToPolicy(statement){return this.addToPrincipalPolicy(statement).statementAdded}addToPrincipalPolicy(statement){return jsiiDeprecationWarnings.aws_cdk_lib_aws_iam_PolicyStatement(statement),this.role.addToPrincipalPolicy(statement)}}exports.ServiceAccount=ServiceAccount,_a=JSII_RTTI_SYMBOL_1,ServiceAccount[_a]={fqn:"aws-cdk-lib.aws_eks.ServiceAccount",version:"2.13.0"};
//# sourceMappingURL=service-account.js.map
