# Workload Identity binding documentation.
#
# This file is NOT applied with kubectl — it documents the gcloud commands
# executed by etc/init_cnpg_gke.sh to establish the Workload Identity link
# between the Kubernetes ServiceAccount (cnpg-backup-sa) and the GCP
# service account (cnpg-backup@<project>.iam.gserviceaccount.com).
#
# Commands run by init_cnpg_gke.sh:
#
#   gcloud iam service-accounts create cnpg-backup \
#     --display-name="CNPG GCS Backup" \
#     --project=$GCP_PROJECT_ID
#
#   gsutil iam ch \
#     serviceAccount:cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com:objectAdmin \
#     gs://knoe-0-backups
#
#   gcloud iam service-accounts add-iam-policy-binding \
#     cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com \
#     --role=roles/iam.workloadIdentityUser \
#     --member="serviceAccount:$GCP_PROJECT_ID.svc.id.goog[knoe-db-0/cnpg-backup-sa]"
#
#   kubectl annotate serviceaccount cnpg-backup-sa \
#     -n knoe-db-0 \
#     iam.gke.io/gcp-service-account=cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com \
#     --overwrite