apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: jack-bot-webhook-secret spec: data: - remoteRef: key: jack-bot-gh-app-webhook secretKey: GITHUB_APP_WEBHOOK_SECRET refreshInterval: 1m secretStoreRef: name: gcp-provider kind: ClusterSecretStore target: name: jack-bot-webhook-secret creationPolicy: Owner --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicyMember metadata: name: essa-jack-bot-gh-app-webhook spec: member: serviceAccount:ext-sec-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com resourceRef: apiVersion: secretmanager.cnrm.cloud.google.com/v1beta1 kind: SecretManagerSecret external: projects/${gcp_project_id}/secrets/jack-bot-gh-app-webhook role: roles/secretmanager.secretAccessor