{{- /*
ServiceAccount for useraccess-controller (slice C5 / CC3 of EPIC-0 #1095).

Reconciles UserAccess.access.openova.io/v1 CRs into RoleBinding +
ClusterRoleBinding objects. Default off — flipping this to true is what
RETIRES the broken Crossplane Composition path documented in
docs/EPICS-1-6-unified-design.md §3.5 (provider-kubernetes is not
installed on any production Sovereign — silent P0 bug).
*/ -}}
{{- if .Values.controllers.useraccess.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "controllers.fullname" "useraccess" }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "controllers.labels" (dict "name" "useraccess" "root" .) | nindent 4 }}
{{- end }}
