kubevela/docs/examples/registry/dynamic-sa.yaml

apiVersion: core.oam.dev/v1beta1
kind: TraitDefinition
metadata:
  annotations:
    definition.oam.dev/description: "dynamically specify service account"
  name: service-account
spec:
  appliesToWorkloads:
    - webservice
    - worker
  schematic:
    cue:
      template: |-
        processing: {
          output: {
              credentials?: string
          }
          http: {
              method: *"GET" | string
              url:    parameter.serviceURL
              request: {
                  header: {
                      "authorization.token": parameter.uidtoken
                  }
              }
          }
        }
        patch: {
          spec: template: spec: serviceAccountName: processing.output.credentials
        }
        parameter: {
          uidtoken:   string
          serviceURL: string
        }