apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPartialPolicy metadata: name: flux-source-controller-storage-access namespace: flux-system annotations: cnrm.cloud.google.com/project-id: ${gcp_project_id} description: | Grants storage permissions for reading from GCS to Flux source controller pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z" pallet.edge.ncr.com/name: fluxcd-operators pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra' pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a labels: cluster_hash: ${cluster_hash} cluster_uuid: ${cluster_uuid} spec: bindings: - members: - member: serviceAccount:flux-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com role: projects/${gcp_project_id}/roles/fluxread resourceRef: apiVersion: storage.cnrm.cloud.google.com/v1beta1 kind: StorageBucket external: ${gcp_project_id} --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicyMember metadata: name: flux-source-controller-workload-id namespace: flux-system annotations: cnrm.cloud.google.com/project-id: ${gcp_project_id} description: | Binds the K8s SA used by the Flux sourcecontroller to the GCP IAM service account defined in the base. pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z" pallet.edge.ncr.com/name: fluxcd-operators pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra' pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a labels: cluster_hash: ${cluster_hash} cluster_uuid: ${cluster_uuid} spec: member: serviceAccount:${gcp_project_id}.svc.id.goog[flux-system/source-controller] resourceRef: name: flux-source-controller apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount role: roles/iam.workloadIdentityUser --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata: name: flux-source-controller namespace: flux-system annotations: cnrm.cloud.google.com/project-id: ${gcp_project_id} description: Used by Flux source controller pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z" pallet.edge.ncr.com/name: fluxcd-operators pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra' pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a labels: cluster_hash: ${cluster_hash} cluster_uuid: ${cluster_uuid} spec: resourceID: flux-${cluster_hash}