{{- /*
ServiceAccount — 当 serviceAccount.create=true 时创建。
workloadIdentity.enabled=true 时：
  1) automountServiceAccountToken=false（禁用默认 token 投递）
  2) 额外创建 type=service-account-token 的 Secret（projected token），供 KMS/HSM 使用
*/ -}}
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "agentkit.serviceAccountName" . }}
  labels:
    {{- include "agentkit.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- if .Values.workloadIdentity.enabled }}
automountServiceAccountToken: false
{{- end }}
{{- end }}
{{- if and .Values.serviceAccount.create .Values.workloadIdentity.enabled }}
---
# ponytail: projected SA token — 限时令牌，供 KMS/HSM workload identity 换取访问凭据。
# 升级路径：云厂商原生 workload identity 注解（P1，避免手动 token 投递）。
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "agentkit.serviceAccountName" . }}-token
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "agentkit.labels" . | nindent 4 }}
  annotations:
    kubernetes.io/service-account.name: {{ include "agentkit.serviceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}