apiVersion: v1
kind: ServiceAccount
metadata:
  name: approval-service
  namespace: agent-trust
  labels:
    app.kubernetes.io/name: approval-service
    app.kubernetes.io/part-of: proofedmesh
    app.kubernetes.io/component: trust-core
# The approval-service does not call the Kubernetes API; it talks only to
# signing-service, transparency-log, trust-pg, and Pocket-ID. Opt the SA
# out of auto-mounting since no in-pod kube client is used.
automountServiceAccountToken: false