apiVersion: v1
kind: ServiceAccount
metadata:
  name: dummy-sink
  namespace: agent-trust
  labels:
    app.kubernetes.io/name: dummy-sink
    app.kubernetes.io/part-of: proofedmesh
    app.kubernetes.io/component: sink
# dummy-sink uses an EXPLICIT projected SA token mounted into
# /var/run/secrets/tokens/trust-api as the second half of the
# signing-service double-identity contract (DEV-611). The default
# auto-mount is disabled so the pod only sees that scoped token.
automountServiceAccountToken: false