Per-action ServiceAccounts

{% if not configured %}

Kubernetes unconfigured — no kubeconfig found.

{% elif sas %} {% for sa in sas %} {% endfor %}
namespacenameage
{{ sa.namespace }} {{ sa.name }} {% if sa.age_hours is not none %}{{ '%.1f'|format(sa.age_hours) }}h{% else %}—{% endif %}

Each SA mints 5-min TokenRequest JWTs on demand. Presence here = action wired for that (verb, namespace).

{% else %}

No secureops-action-* ServiceAccounts in this cluster.

{% endif %}