gcloud iam service-accounts add-iam-policy-binding [email protected] \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:my-project.svc.id.goog[triggermesh/triggermesh-controller]"

gcloud iam service-accounts add-iam-policy-binding [email protected] \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:my-project.svc.id.goog[my-namespace/googlecloudpubsubsource-adapter]"

kubectl annotate serviceaccount triggermesh-controller \
    --namespace triggermesh \
    iam.gke.io/[email protected]

apiVersion: sources.triggermesh.io/v1alpha1
kind: GoogleCloudPubSubSource
metadata:
  name: sample
  annotations:
    iam.gke.io/gcp-service-account: [email protected]
spec:
  topic: projects/my-project/topics/my-topic

  sink:
    ref:
      apiVersion: eventing.knative.dev/v1
      kind: Broker
      name: default