{{ end }}
  {{- range $idx, $svc := .Values.svcaccts }}
  {{- if $svc.policy }}
  # SVC: {{ $svc.accessKey }}
  svc_policy_{{ $idx }}.json: |-
    {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }}
  {{- end }}
  {{- end }}
  add-svcacct: |-
    {{- include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | nindent 4 }}

    rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
    return 1
  fi
  SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
  # Create the svcacct if it does not exist
  if ! checkSvcacctExists ; then
    echo "Creating svcacct '$SVCACCT'"
    # Check if policy file is define
    if [ -z $FILENAME ]; then

0","sa-policy":"inherited-policy","sub":"Cit1aWQ9ZGlsbG9uLG91"},"sessionPolicy":null,"status":"on","name":"","description":"","expiration":"1970-01-01T00:00:00Z"},"dillon-svcacct-1":{"parent":"oCnAoSQFtdVQtKwrB73j","accessKey":"dillon-svcacct-1","secretKey":"dillon-svcacct-1","groups":null,"claims":{"accessKey":"dillon-svcacct-1","parent":"oCnAoSQFtdVQtKwrB73j","sa-policy":"embedded-policy","sessionPolicy":"eyJWZXJzaW9uIjoiIiwi==","sessionPolicy-extracted":"{\"Version\":\"\",\"Statement\":null}"...

[{"Effect":"Allow","Action":["s3:PutObject"],"Resource":["arn:aws:s3:::*"]}]}} iam-assets/users.json {} iam-assets/groups.json {} iam-assets/svcaccts.json {"bobfisher-svcacct-1":{"parent":"uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io","accessKey":"bobfisher-svcacct-1","secretKey":"bobfisher-svcacct-1","groups":null,"claims":{"accessKey":"bobfisher-svcacct-1","ldapActualUser":"uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io","ldapUser":"uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io","ldapUserna...

# Create service account for STS user
./mc admin user svcacct add minio2 $STS_ACCESS_KEY --access-key testsvc --secret-key testsvc123
if [ $? -ne 0 ]; then
	echo "adding svc account failed, exiting.."
	exit_1
fi

sleep 10

./mc admin user svcacct info minio1 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio2 testsvc
if [ $? -ne 0 ]; then

	echo "BUG: Expected no of users: 2 Found: ${USER_COUNT}"
	exit 1
fi
./mc admin user svcacct list myminio "uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io" --json
SVCACCT_COUNT_1=$(./mc admin user svcacct list myminio "uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io" --json | jq '.accessKey' | wc -l)
if [ "${SVCACCT_COUNT_1}" -ne 2 ]; then
	echo "BUG: Expected svcacct count for 'uid=bobfisher,ou=people,ou=hwengg,dc=min,dc=io': 2. Found: ${SVCACCT_COUNT_1}"
	exit 1

// writeKubeConfigFile will rewrite/replace the kubeconfig used by the CNI plugin.
// We are the only consumers of this file and it resides in our owned rundir on the host node,
// so we are good to simply write it out if our watched svcacct token changes.
func writeKubeConfigFile(cfg *config.InstallConfig) error {
	kc, err := createKubeConfig(cfg)
	if err != nil {
		return err
	}