---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    # Used by container image promotor audit jobs
    # TODO(fejta): better define these rules and enforce them in presubmit.
    iam.gke.io/gcp-service-account: k8s-infra-gcr-promoter@k8s-gcr-audit-test-prod.iam.gserviceaccount.com
  name: k8s-gcr-audit-test-prod
  namespace: test-pods
---
# TODO(fejta): any other service accounts

---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    # Used by container image promotor audit jobs
    # TODO(fejta): better define these rules and enforce them in presubmit.
    iam.gke.io/gcp-service-account: k8s-infra-gcr-promoter@k8s-gcr-audit-test-prod.iam.gserviceaccount.com
  name: k8s-gcr-audit-test-prod
  namespace: test-pods
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    # Used by Kops testing jobs
    iam.gke.io/gcp-service-account: pr-kubekins@kubernetes-jenkins-pull.iam.gserviceaccount.com
  name: k8s-kops-test
  namespace: test-pods
---
# TODO(fejta): any other service accounts

Create a service account for kops jobs
Create a service account for kops jobs

I wasn't sure how granular to make this service account so I went with all kops testing jobs but I'm certainly open to other names.
Once this is created I'll start updating the kops jobs to use this service account.
