#
#  Author: Hari Sekhon
#  Date: [% DATE  # 2021-01-13 15:42:59 +0000 (Wed, 13 Jan 2021) %]
#
#  vim:ts=2:sts=2:sw=2:et
#
#  https://github.com/HariSekhon/Kubernetes-configs
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

---
apiVersion: v1
kind: ServiceAccount
metadata:
  # GKE Workload Identity integration - map your k8s serviceaccount to a GCP serviceaccount with permissions to access GCP resources
  #
  # you'll also need to grant GCP IAM permissions for the k8s SA to use the GCP SA:
  # XXX: Edit or Set env vars:  $CLOUDSDK_CORE_PROJECT, $K8_NAMESPACE, $K8_SA, $GSA
  #
  #   gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:$CLOUDSDK_CORE_PROJECT.svc.id.goog[$K8_NAMESPACE/$K8_SA]" "$GSA@$CLOUDSDK_CORE_PROJECT.iam.gserviceaccount.com"
  #
  annotations:
    # XXX: Edit GSA + PROJECT_ID if using GKE Workload Identity
    iam.gke.io/gcp-service-account: GSA@PROJECT_ID.iam.gserviceaccount.com
  name: NAME
  namespace: NAME
automountServiceAccountToken: false
