kubevela/docs/examples/registry/dynamic-sa.yaml

apiVersion: core.oam.dev/v1alpha2
kind: TraitDefinition
metadata:
  annotations:
    definition.oam.dev/description: "dynamically specify service account"
  name: service-account
spec:
  appliesToWorkloads:
    - webservice
    - worker
  extension:
    template: |-
      processing: {
      	output: {
      		credentials?: string
      	}
      	http: {
      		method: *"GET" | string
      		url:    parameter.serviceURL
      		request: {
      			header: {
      				"authorization.token": parameter.uidtoken
      			}
      		}
      	}
      }
      patch: {
      	spec: template: spec: serviceAccountName: processing.output.credentials
      }

      parameter: {
      	uidtoken:   string
      	serviceURL: string
      }