apiVersion: v1
kind: ServiceAccount
metadata:
name: api-gateway
namespace: api
labels:
app: api-gateway
---
# No ClusterRole needed - the gateway has no k8s API access
# G2: The gateway holds no Kubernetes credentials