apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: flux-source-controller-storage-access
  namespace: flux-system
  annotations:
    cnrm.cloud.google.com/project-id: ${gcp_project_id}
    description: |
      Grants storage permissions for reading from GCS to Flux source controller
    pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
    pallet.edge.ncr.com/name: fluxcd-operators
    pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
    pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
    pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
    pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
  labels:
    cluster_hash: ${cluster_hash}
    cluster_uuid: ${cluster_uuid}
spec:
  bindings:
  - members:
    - member: serviceAccount:flux-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com
    role: projects/${gcp_project_id}/roles/fluxread
  resourceRef:
    apiVersion: storage.cnrm.cloud.google.com/v1beta1
    kind: StorageBucket
    external: ${gcp_project_id}
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: flux-source-controller-workload-id
  namespace: flux-system
  annotations:
    cnrm.cloud.google.com/project-id: ${gcp_project_id}
    description: |
      Binds the K8s SA used by the Flux sourcecontroller to the GCP IAM
      service account defined in the base.
    pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
    pallet.edge.ncr.com/name: fluxcd-operators
    pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
    pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
    pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
    pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
  labels:
    cluster_hash: ${cluster_hash}
    cluster_uuid: ${cluster_uuid}
spec:
  member: serviceAccount:${gcp_project_id}.svc.id.goog[flux-system/source-controller]
  resourceRef:
    name: flux-source-controller
    apiVersion: iam.cnrm.cloud.google.com/v1beta1
    kind: IAMServiceAccount
  role: roles/iam.workloadIdentityUser
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMServiceAccount
metadata:
  name: flux-source-controller
  namespace: flux-system
  annotations:
    cnrm.cloud.google.com/project-id: ${gcp_project_id}
    description: Used by Flux source controller
    pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
    pallet.edge.ncr.com/name: fluxcd-operators
    pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
    pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
    pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
    pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
  labels:
    cluster_hash: ${cluster_hash}
    cluster_uuid: ${cluster_uuid}
spec:
  resourceID: flux-${cluster_hash}