<p>I'm trying to create a Kubernetes deployment with an associated ServiceAccount, which is <a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="noreferrer">linked to an AWS IAM role</a>. This yaml produces the desired result and the associated deployment (included at the bottom) spins up correctly:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: service-account
  namespace: example
  annotations:
    eks.amazonaws.com/role-arn: ROLE_ARN
</code></pre>

<p>However, I would like to instead use the Terraform Kubernetes provider to create the ServiceAccount:</p>

<pre><code>resource "kubernetes_service_account" "this" {
  metadata {
    name = "service-account2"
    namespace = "example"
    annotations = {
      "eks.amazonaws.com/role-arn" = "ROLE_ARN"
    }
  }
}
</code></pre>

<p>Unfortunately, when I create the ServiceAccount this way, the ReplicaSet for my deployment fails with the error:</p>

<pre><code>Error creating: Internal error occurred: Internal error occurred: jsonpatch add operation does not apply: doc is missing path: "/spec/volumes/0"
</code></pre>

<p>I have confirmed that it does not matter whether the Deployment is created via Terraform or <code>kubectl</code>; it will not work with the Terraform-created <code>service-account2</code>, but works fine with the <code>kubectl</code>-created <code>service-account</code>. Switching a deployment back and forth between <code>service-account</code> and <code>service-account2</code> correspondingly makes it work or not work as you might expect.</p>

<p>I have also determined that the <code>eks.amazonaws.com/role-arn</code> is related; creating/assigning ServiceAccounts that do not try to link back to an IAM role work regardless of whether they were created via Terraform or <code>kubectl</code>.</p>

<p>Using <code>kubectl</code> to describe the Deployment, ReplicaSet, ServiceAccount, and associated Secret, I don't see any obvious differences, though I will admit I'm not entirely sure what I might be looking for.</p>

<p>Here is a simple deployment yaml that exhibits the problem:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: example
  namespace: example
spec:
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: example
    spec:
      serviceAccountName: service-account # or "service-account2"
      containers:
      - name: nginx
        image: nginx:1.7.8
</code></pre>

<p>Adding <code>automountServiceAccountToken: true</code> to the pod spec in your deployment should fix this error.  This is usually enabled by default on service accounts, but Terraform defaults it to off.  See this issue on the mutating web hook that adds the required environment variables to your pods: <a href="https://github.com/aws/amazon-eks-pod-identity-webhook/issues/17" rel="noreferrer">https://github.com/aws/amazon-eks-pod-identity-webhook/issues/17</a></p>
