apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitea-runner
  namespace: ci
  annotations:
    # Workload Identity — allows ESO (and optionally the runner pod) to
    # authenticate to GCP Secret Manager as the gitea-runner-gke GCP SA
    # without a JSON key file.
    # The GCP SA binding is in servers/gcp/gitea-runner.tf (gitea_runner_gke_workload_identity).
    iam.gke.io/gcp-service-account: gitea-runner-gke@neuron-785695.iam.gserviceaccount.com