# Use Workload Identity (https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
# to allow the Preflight pod to query the Google Cloud API for information about GKE. This relies
# on an out-of-cluster Google Cloud service account existing.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: preflight-scanner
  annotations:
    # Example, replace with your Google cloud service account name
    iam.gke.io/gcp-service-account: preflight-scanner@<project>.iam.gserviceaccount.com
