# A stable identity for the pods. The server never talks to the Kubernetes API
# (blocklist replication goes through Valkey, not the API server), so the token
# is not just unused but actively undesirable: automounting it would hand every
# pod a credential it has no reason to hold.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fancy-dns
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
automountServiceAccountToken: false