ingester-serviceaccount.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Values.ingester.serviceAccountName }}
  annotations:
    # The following annotation connects the Kubernetes ServiceAccount to a GCP
    # IAM Service Account, granting access to resources on GCP, via the
    # "Workload Identity" framework.
    #
    # https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
    iam.gke.io/gcp-service-account: "{{ .Values.ingester.gcp.serviceAccountName }}@{{ .Values.ingester.gcp.projectID }}.iam.gserviceaccount.com"