apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitea
  namespace: gitea
  annotations:
    # Workload Identity — allows the Cloud SQL Auth Proxy sidecar to authenticate
    # to Cloud SQL as the gitea GCP SA without a JSON key file.
    # The GCP SA binding is in servers/gcp/gke.tf (gitea_workload_identity).
    iam.gke.io/gcp-service-account: gitea-gke@neuron-785695.iam.gserviceaccount.com