apiVersion: v1
kind: ServiceAccount
metadata:
  name: mysa
  namespace: default
  annotations:
    eks.amazonaws.com/role-arn: "arn:aws:iam::<AWS_ACCOUNT>:role/myrole"
    eks.amazonaws.com/audience: "k3s"
    eks.amazonaws.com/sts-regional-endpoints: "true"
    eks.amazonaws.com/token-expiration: "86400"

---

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: mysa
  containers:
  - name: alpine
    image: alpine:latest
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo 'Hello, World!'; sleep 10; done"]