1apiVersion: iam.cnrm.cloud.google.com/v1beta1
2kind: IAMPartialPolicy
3metadata:
4 name: flux-source-controller-storage-access
5 namespace: flux-system
6 annotations:
7 cnrm.cloud.google.com/project-id: ${gcp_project_id}
8 description: |
9 Grants storage permissions for reading from GCS to Flux source controller
10 pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
11 pallet.edge.ncr.com/name: fluxcd-operators
12 pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
13 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
14 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
15 pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
16 labels:
17 cluster_hash: ${cluster_hash}
18 cluster_uuid: ${cluster_uuid}
19spec:
20 bindings:
21 - members:
22 - member: serviceAccount:flux-${cluster_hash}@${gcp_project_id}.iam.gserviceaccount.com
23 role: projects/${gcp_project_id}/roles/fluxread
24 resourceRef:
25 apiVersion: storage.cnrm.cloud.google.com/v1beta1
26 kind: StorageBucket
27 external: ${gcp_project_id}
28---
29apiVersion: iam.cnrm.cloud.google.com/v1beta1
30kind: IAMServiceAccount
31metadata:
32 name: flux-source-controller
33 namespace: flux-system
34 annotations:
35 cnrm.cloud.google.com/project-id: ${gcp_project_id}
36 description: Used by Flux source controller
37 pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
38 pallet.edge.ncr.com/name: fluxcd-operators
39 pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
40 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
41 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
42 pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
43 labels:
44 cluster_hash: ${cluster_hash}
45 cluster_uuid: ${cluster_uuid}
46spec:
47 resourceID: flux-${cluster_hash}
48---
49apiVersion: iam.cnrm.cloud.google.com/v1beta1
50kind: IAMServiceAccountKey
51metadata:
52 name: flux-source-ctl-gcp-api-key
53 namespace: flux-system
54 annotations:
55 cnrm.cloud.google.com/project-id: ${gcp_project_id}
56 pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
57 pallet.edge.ncr.com/name: fluxcd-operators
58 pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
59 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
60 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
61 pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
62 labels:
63 cluster_hash: ${cluster_hash}
64 cluster_uuid: ${cluster_uuid}
65spec:
66 serviceAccountRef:
67 name: flux-source-controller
68---
69apiVersion: secretmanager.cnrm.cloud.google.com/v1beta1
70kind: SecretManagerSecret
71metadata:
72 name: flux-source-ctl-${cluster_uuid}-gcp-api-key
73 namespace: flux-system
74 annotations:
75 cnrm.cloud.google.com/project-id: ${gcp_project_id}
76 pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
77 pallet.edge.ncr.com/name: fluxcd-operators
78 pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
79 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
80 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
81 pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
82 labels:
83 cluster_hash: ${cluster_hash}
84 cluster_uuid: ${cluster_uuid}
85spec:
86 replication:
87 automatic: true
88---
89apiVersion: secretmanager.cnrm.cloud.google.com/v1beta1
90kind: SecretManagerSecretVersion
91metadata:
92 name: flux-source-ctl-${cluster_uuid}-gcp-api-key
93 namespace: flux-system
94 annotations:
95 cnrm.cloud.google.com/project-id: ${gcp_project_id}
96 pallet.edge.ncr.com/created: "2023-02-16T21:26:39Z"
97 pallet.edge.ncr.com/name: fluxcd-operators
98 pallet.edge.ncr.com/revision: 696897a3df910b6e84a88c9336907a17b18159c1
99 pallet.edge.ncr.com/source: https://github.com/ncrvoyix-swt-retail/edge-infra/tree/696897a3df910b6e84a88c9336907a17b18159c1
100 pallet.edge.ncr.com/team: '@ncrvoyix-swt-retail/edge-infra'
101 pallet.edge.ncr.com/version: 7.7.7-rc.1676582799+commit.696897a
102 labels:
103 cluster_hash: ${cluster_hash}
104 cluster_uuid: ${cluster_uuid}
105spec:
106 secretRef:
107 name: flux-source-ctl-${cluster_uuid}-gcp-api-key
108 enabled: true
109 secretData:
110 valueFrom:
111 secretKeyRef:
112 name: flux-source-ctl-gcp-api-key
113 key: key.json
View as plain text