{{- /*
ServiceAccount used by every step Job (stamped by catalyst-api from the
PodSpec ConfigMaps in this chart) AND by the registry-pivot DaemonSet
that ships in this chart. Single SA → single RBAC binding to audit.

Per docs/INVIOLABLE-PRINCIPLES.md §10 (credential hygiene), tokens are
auto-mounted at /var/run/secrets/kubernetes.io/serviceaccount and never
echoed; step PodSpecs talk to the in-cluster API via these tokens, no
plaintext kubeconfig ships in this chart.
*/ -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "bp-self-sovereign-cutover.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-self-sovereign-cutover.labels" . | nindent 4 }}
