apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: auth spec: data: - remoteRef: key: edge-backend-jwt-secret secretKey: APP_SECRET - remoteRef: key: edge-backend-launch-darkly-sdk-key secretKey: LD_KEY refreshInterval: 1m secretStoreRef: name: gcp-provider kind: ClusterSecretStore target: name: auth creationPolicy: Owner --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicyMember metadata: name: essa-edge-backend-jwt-secret spec: member: serviceAccount:ext-sec-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com resourceRef: apiVersion: secretmanager.cnrm.cloud.google.com/v1beta1 kind: SecretManagerSecret external: projects/${gcp_project_id}/secrets/edge-backend-jwt-secret role: roles/secretmanager.secretAccessor --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicyMember metadata: name: edge-backend-launch-darkly-sdk-key spec: member: serviceAccount:ext-sec-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com resourceRef: apiVersion: secretmanager.cnrm.cloud.google.com/v1beta1 kind: SecretManagerSecret external: projects/${gcp_project_id}/secrets/edge-backend-launch-darkly-sdk-key role: roles/secretmanager.secretAccessor --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: edge-totp-secret-key spec: data: - remoteRef: key: edge-backend-totp-secret secretKey: TOTP_SECRET_KEY refreshInterval: 1m secretStoreRef: name: gcp-provider kind: ClusterSecretStore target: name: edge-totp-secret-key creationPolicy: Owner --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicyMember metadata: name: essa-edge-totp-secret-key spec: member: serviceAccount:ext-sec-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com resourceRef: apiVersion: secretmanager.cnrm.cloud.google.com/v1beta1 kind: SecretManagerSecret external: projects/${gcp_project_id}/secrets/edge-backend-totp-secret role: roles/secretmanager.secretAccessor --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: okta-client-id spec: data: - remoteRef: key: ${okta_secret_key} secretKey: OKTA_CLIENT_ID refreshInterval: 1m secretStoreRef: name: okta-provider kind: ClusterSecretStore target: name: okta-client-id creationPolicy: Owner