Add rotate directive to serviceaccount.tf (see keepers: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key#keepers)
This will update k8s secret called api-serviceaccount
This is used by both backups and the api deployments
Just the api deployments need to be restarted since the backups will start fresh in the night