mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
620bdd25eb
Add complete GKE deployment stack: - deploy/gcp/gke/: namespace, CloudNativePG cluster (premium-rwo, 100Gi), GCS barman-cloud backup with Workload Identity SA, ArgoCD OIDC ConfigMap, GitLab OmniAuth secret template, knoe-auth Google OIDC secret template - etc/init_cnpg_gke.sh: provision GCS buckets, GCP SA, WI binding, CNPG operator - etc/init_argocd.sh: apply argocd-oidc-cm.yaml when PLATFORM_DOMAIN/FRONTDOOR_HOST set - etc/init_gitlab.sh: inject OmniAuth openid_connect block when FRONTDOOR_HOST set - prole-auth-deployment.yaml: add GOOGLE_OIDC_ENABLED env vars (all optional) - supabase/helm/prole-supabase/values-gke.yaml: GoTrue Google OAuth overlay - knoe/core/prod_config.py: add backupProvider, workloadIdentitySA, googleClientId/Secret/HostedDomain Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
# Workload Identity binding documentation.
|
|
#
|
|
# This file is NOT applied with kubectl — it documents the gcloud commands
|
|
# executed by etc/init_cnpg_gke.sh to establish the Workload Identity link
|
|
# between the Kubernetes ServiceAccount (cnpg-backup-sa) and the GCP
|
|
# service account (cnpg-backup@<project>.iam.gserviceaccount.com).
|
|
#
|
|
# Commands run by init_cnpg_gke.sh:
|
|
#
|
|
# gcloud iam service-accounts create cnpg-backup \
|
|
# --display-name="CNPG GCS Backup" \
|
|
# --project=$GCP_PROJECT_ID
|
|
#
|
|
# gsutil iam ch \
|
|
# serviceAccount:cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com:objectAdmin \
|
|
# gs://knoe-0-backups
|
|
#
|
|
# gcloud iam service-accounts add-iam-policy-binding \
|
|
# cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com \
|
|
# --role=roles/iam.workloadIdentityUser \
|
|
# --member="serviceAccount:$GCP_PROJECT_ID.svc.id.goog[ecosystem-0/cnpg-backup-sa]"
|
|
#
|
|
# kubectl annotate serviceaccount cnpg-backup-sa \
|
|
# -n ecosystem-0 \
|
|
# iam.gke.io/gcp-service-account=cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com \
|
|
# --overwrite
|