---
# Kubernetes ServiceAccount bound to the GCP service account via Workload Identity.
# The CNPG operator uses this SA to authenticate against GCS without a static key.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cnpg-backup-sa
  namespace: knoe-db-0
  annotations:
    # Set by etc/init_cnpg_gke.sh — substituted at deploy time
    iam.gke.io/gcp-service-account: "cnpg-backup@${GCP_PROJECT_ID}.iam.gserviceaccount.com"