apiVersion: v1
kind: ServiceAccount
metadata:
  name: manager-service-account
  namespace: system
  ## If using GCP workload identity, annotate the service account with the gsa-name
  # annotations:
  #   iam.gke.io/gcp-service-account: secret-manager@engineering-devops.iam.gserviceaccount.com