{{- if (.Values.serviceAccount.operator).create | default .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
    {{- if .Values.podIdentity.azureWorkload.enabled }}
    azure.workload.identity/use: "true"
    {{- end }}
    {{- include "keda.labels" . | nindent 4 }}
  {{- if or .Values.podIdentity.azureWorkload.enabled .Values.podIdentity.aws.irsa.enabled ((.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations) .Values.podIdentity.gcp.enabled }}
  annotations:
    {{- if .Values.additionalAnnotations }}
    {{- toYaml .Values.additionalAnnotations | nindent 4 }}
    {{- end }}
    {{- if .Values.podIdentity.azureWorkload.enabled }}
    {{- if .Values.podIdentity.azureWorkload.clientId }}
    azure.workload.identity/client-id: {{ .Values.podIdentity.azureWorkload.clientId | quote }}
    {{- end }}
    {{- if .Values.podIdentity.azureWorkload.tenantId }}
    azure.workload.identity/tenant-id: {{ .Values.podIdentity.azureWorkload.tenantId | quote }}
    {{- end }}
    azure.workload.identity/service-account-token-expiration: {{ .Values.podIdentity.azureWorkload.tokenExpiration | quote }}
    {{- end }}
    {{- if .Values.podIdentity.aws.irsa.enabled }}
    {{- if .Values.podIdentity.aws.irsa.audience }}
    eks.amazonaws.com/audience: {{ .Values.podIdentity.aws.irsa.audience | quote }}
    {{- end }}
    {{- if .Values.podIdentity.aws.irsa.roleArn }}
    eks.amazonaws.com/role-arn: {{ .Values.podIdentity.aws.irsa.roleArn | quote }}
    {{- end }}
    {{- if .Values.podIdentity.aws.irsa.stsRegionalEndpoints }}
    eks.amazonaws.com/sts-regional-endpoints: {{ .Values.podIdentity.aws.irsa.stsRegionalEndpoints | quote }}
    {{- end }}
    eks.amazonaws.com/token-expiration: {{ .Values.podIdentity.aws.irsa.tokenExpiration | quote }}
    {{- end }}
    {{- if .Values.podIdentity.gcp.enabled }}
    {{- if .Values.podIdentity.gcp.gcpIAMServiceAccount }}
    iam.gke.io/gcp-service-account: {{ .Values.podIdentity.gcp.gcpIAMServiceAccount }}
    {{- end }}
    {{- end }}
    {{- if (.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations }}
    {{- toYaml ((.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations) | nindent 4}}
    {{- end }}
  {{- end }}
  name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
  namespace: {{ .Release.Namespace }}
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.operator).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.operator).automountServiceAccountToken }}
{{- end -}}