apiVersion: v1
kind: ServiceAccount
metadata:
  name: s3-encrypted-file-pod
  # setup.sh fills in the namespace at apply time.
  labels:
    app.kubernetes.io/managed-by: s3-encrypted-file
# The pod needs no Kubernetes API access, so it gets no Kubernetes token. Its AWS
# credentials come from the EKS Pod Identity association setup.sh creates for this service
# account, which the webhook delivers through its own projected volume and the in-guest
# credential endpoint, not through this one.
automountServiceAccountToken: false