# =============================================================================
# ServiceAccount Template — AKS Deploy Skill
# =============================================================================
# Kubernetes ServiceAccount with Azure Workload Identity annotation.
# The annotation links this SA to an Azure Managed Identity via OIDC federation.
#
# Prerequisites:
#   1. A User-Assigned Managed Identity exists in Azure
#   2. A Federated Identity Credential is configured with:
#      - Issuer:  <AKS cluster OIDC issuer URL>
#      - Subject: system:serviceaccount:<namespace>:<app-name>
#      - Audience: api://AzureADTokenExchange
#
# REPLACE: <app-name>          — your application name (e.g., order-api)
# REPLACE: <namespace>         — target namespace (e.g., production)
# REPLACE: <azure-client-id>   — client ID of the Managed Identity
# =============================================================================
apiVersion: v1
kind: ServiceAccount
metadata:
  name: <app-name>
  namespace: <namespace>
  labels:
    app: <app-name>
  annotations:
    # Workload Identity: maps this ServiceAccount to an Azure Managed Identity.
    # The Workload Identity webhook reads this annotation and injects
    # AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_FEDERATED_TOKEN_FILE
    # into any pod that references this ServiceAccount AND has the label
    # azure.workload.identity/use: "true".
    azure.workload.identity/client-id: "<azure-client-id>"