{{- if .Values.serviceAccount.create }}
# STATE-WP-0084-T02. The OpenBao Kubernetes auth role built by MASON-WP-0003-T02
# binds to this ServiceAccount by name and deliberately does not bind to
# `default` — so the pod must stop running as `default` before the lane can
# carry anything. Creating it here keeps that binding in the release rather than
# in an operator's memory.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Values.serviceAccount.name | quote }}
  labels: {{- include "statehub.labels" . | nindent 4 }}
{{- end }}
