{{- /*
ServiceAccount for organization-controller (slice C1 / CC3 of EPIC-0 #1095).

Reconciles Organization.orgs.openova.io/v1 CRs to per-Org Keycloak realms,
Gitea Org slugs, and per-Org UserAccess CRs. Default off — operator
flips `.Values.controllers.organization.enabled=true` per-Sovereign once
catalyst-api's legacy organization-reconcile loop is ready to retire.
*/ -}}
{{- if .Values.controllers.organization.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "controllers.fullname" "organization" }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "controllers.labels" (dict "name" "organization" "root" .) | nindent 4 }}
{{- end }}
