mirror of
https://github.com/holos-run/holos.git
synced 2026-03-20 17:25:01 +00:00
0771bd6b6c
The provisioner cluster is a worker-less autopilot cluster that provides secrets to other clusters in the platform. The `eso-creds-refresher` Job in the holos-system namespace of each other cluster refreshes service account tokens for SecretStores. This patch adds the IAM structure for the Job implemented by Namespace, ServiceAccount, Role, and RoleBinding api objects.
19 lines
740 B
Bash
Executable File
19 lines
740 B
Bash
Executable File
#! /bin/bash
|
|
#
|
|
|
|
set -euo pipefail
|
|
|
|
export HOLOS_CLUSTER_NAME=$1
|
|
export PROJECT_ID="$(gcloud config get-value project)"
|
|
export PROJECT_NUMBER="$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')"
|
|
|
|
gcloud iam workload-identity-pools create-cred-config \
|
|
projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/holos/providers/k8s-$HOLOS_CLUSTER_NAME \
|
|
--service-account=eso-creds-refresher@$PROJECT_ID.iam.gserviceaccount.com \
|
|
--credential-source-file=/var/run/service-account/token \
|
|
--credential-source-type=text \
|
|
--output-file=gcloud/credential-configuration.json
|
|
|
|
envsubst < gcloud/pod.template.yaml > gcloud/pod.yaml
|
|
envsubst < gcloud/rolebinding.template.yaml > gcloud/rolebinding.yaml
|