apiVersion: v1
kind: ServiceAccount
metadata:
  name: secrets-manager-secret-pod
  # setup.sh fills in the namespace at apply time.
  labels:
    app.kubernetes.io/managed-by: secrets-manager-secret
# The pods need no Kubernetes API access, so they get no Kubernetes token. Their AWS
# credentials come from the EKS Pod Identity association setup.sh creates for this service
# account, which the webhook delivers through its own projected volume and the in-guest
# credential endpoint, not through this one.
#
# Both the sandboxed pod and the no-attestation control pod use this service account, and
# so the same IAM role. That is the whole point of the control: the same credentials,
# without an attestation document.
automountServiceAccountToken: false