# The pod's ServiceAccount, associated through EKS Pod Identity with the role whose only
# grant is iam/signer-verify-policy.json. The guest needs AWS credentials for one reason
# here: signature verification calls AWS Signer to check revocation status before it
# admits a container (Amazon EKS User Guide, "Cedar policies").
apiVersion: v1
kind: ServiceAccount
metadata:
  name: signer-policy-pod
  namespace: signer-policy-sample
# The pod sets automountServiceAccountToken: false on its own spec as well. Pod Identity
# delivers credentials through the projected volume the EKS Pod Identity webhook injects,
# not through a mounted service account token.
automountServiceAccountToken: false