apiVersion: v1
kind: ServiceAccount
metadata:
  name: docuseal
  namespace: docuseal
  annotations:
    # Workload Identity — allows ESO to authenticate to GCP Secret Manager
    # as the docuseal-gke GCP SA without a JSON key file.
    # The GCP SA binding is in servers/gcp/docuseal.tf (docuseal_workload_identity).
    iam.gke.io/gcp-service-account: docuseal-gke@neuron-785695.iam.gserviceaccount.com