{{- /*
ServiceAccount for catalyst-catalog (EPIC-2 Slice L of #1097).

The catalog service does NOT touch the K8s API — it only makes outbound
HTTP calls to the in-cluster Gitea Service. The SA is therefore minimal
(no ClusterRole binding required for K8s resources). The Gitea API token
is mounted as a Secret env-var, NOT via the SA token.
*/ -}}
{{- if .Values.services.catalog.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "catalog.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "catalog.labels" (dict "root" .) | nindent 4 }}
automountServiceAccountToken: false
{{- end }}
