apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-gateway
  namespace: api
  labels:
    app: api-gateway
---
# No ClusterRole needed - the gateway has no k8s API access
# G2: The gateway holds no Kubernetes credentials