apiVersion: v1
kind: ServiceAccount
metadata:
  name: encrypted-image-pod
  # setup.sh fills in the namespace at apply time.
  labels:
    app.kubernetes.io/managed-by: encrypted-image
# The pod needs no Kubernetes API access, so it gets no Kubernetes token. Its AWS
# credentials come from the EKS Pod Identity association setup.sh creates for this
# service account, which the webhook delivers through its own projected volume and the
# in-guest credential endpoint, not through this one.
automountServiceAccountToken: false