mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
620bdd25eb
Add complete GKE deployment stack: - deploy/gcp/gke/: namespace, CloudNativePG cluster (premium-rwo, 100Gi), GCS barman-cloud backup with Workload Identity SA, ArgoCD OIDC ConfigMap, GitLab OmniAuth secret template, knoe-auth Google OIDC secret template - etc/init_cnpg_gke.sh: provision GCS buckets, GCP SA, WI binding, CNPG operator - etc/init_argocd.sh: apply argocd-oidc-cm.yaml when PLATFORM_DOMAIN/FRONTDOOR_HOST set - etc/init_gitlab.sh: inject OmniAuth openid_connect block when FRONTDOOR_HOST set - prole-auth-deployment.yaml: add GOOGLE_OIDC_ENABLED env vars (all optional) - supabase/helm/prole-supabase/values-gke.yaml: GoTrue Google OAuth overlay - knoe/core/prod_config.py: add backupProvider, workloadIdentitySA, googleClientId/Secret/HostedDomain Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
28 lines
813 B
YAML
28 lines
813 B
YAML
---
|
|
# Kubernetes ServiceAccount bound to the GCP service account via Workload Identity.
|
|
# The CNPG operator uses this SA to authenticate against GCS without a static key.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: cnpg-backup-sa
|
|
namespace: ecosystem-0
|
|
annotations:
|
|
# Set by etc/init_cnpg_gke.sh — substituted at deploy time
|
|
iam.gke.io/gcp-service-account: "cnpg-backup@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
|
|
|
|
---
|
|
# Daily scheduled backup at 02:00 UTC.
|
|
# Backup data lands in gs://knoe-0-backups/ (WAL is streamed continuously by CNPG).
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: ScheduledBackup
|
|
metadata:
|
|
name: knoe-db-daily
|
|
namespace: ecosystem-0
|
|
spec:
|
|
schedule: "0 2 * * *"
|
|
backupOwnerReference: self
|
|
cluster:
|
|
name: knoe-db
|
|
method: barmanObjectStore
|
|
immediate: false
|