mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
34a25dde63
deploy/gcp/gke/knoe-db-backup-gcs.yaml previously contained both the cnpg-backup-sa ServiceAccount (wanted) and a ScheduledBackup using method: barmanObjectStore (unwanted — legacy in-tree method being removed in CNPG v1.30, and the live cluster already has a plugin-method ScheduledBackup that would be duplicated on re-apply). Verified no other consumers of knoe-db-daily in the repo (grep clean). File is now SA-only, matching its filename's intent. Part 1/2 of queue item #6 fix (docs/plans/junie/06-patch-garage-script-fixes.md). Co-authored-by: Junie <junie@jetbrains.com>
12 lines
435 B
YAML
12 lines
435 B
YAML
---
|
|
# Kubernetes ServiceAccount bound to the GCP service account via Workload Identity.
|
|
# The CNPG operator uses this SA to authenticate against GCS without a static key.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: cnpg-backup-sa
|
|
namespace: knoe-db-0
|
|
annotations:
|
|
# Set by etc/init_cnpg_gke.sh — substituted at deploy time
|
|
iam.gke.io/gcp-service-account: "cnpg-backup@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
|