Service accounts

The AccessPolicy CRD includes auth.serviceAccount (name + namespace). The operator does not authenticate projected ServiceAccount tokens. src/api/auth.rs builds providers for OIDC, static tokens, and SSH only.

For a Job or controller in the host cluster, create a token Secret and pass it as KOBE_TOKEN, or use OIDC if the workload can mint a JWT.

Do not set auth.serviceAccount expecting it to work. The field is in the schema; the API ignores it.