in internal/workload/podspec_updates.go [923:932]
func (s *updateState) addAuthentication(p *cloudsqlapi.AuthProxyWorkload) {
if p.Spec.AuthProxyContainer == nil || p.Spec.AuthProxyContainer.Authentication == nil {
return
}
as := p.Spec.AuthProxyContainer.Authentication
if len(as.ImpersonationChain) > 0 {
s.addProxyContainerEnvVar(p, "CSQL_PROXY_IMPERSONATE_SERVICE_ACCOUNT", strings.Join(as.ImpersonationChain, ","))
}
}