apiVersion: v1
kind: Secret
metadata:
  name: infisical-token-reviewer
  namespace: infisical-operator
  annotations:
    kubernetes.io/service-account.name: infisical-token-reviewer
type: kubernetes.io/service-account-token
# .data is populated by the cluster token controller — never committed to git.
# ArgoCD ignores /data on this Secret (see application-infisical-operator-rbac.yaml).