From 3d581368c34cea7eaf61245af958ba71fe62f618 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Mon, 4 May 2026 22:37:17 -0500 Subject: [PATCH] fix(vault-gke): relax topology spread to ScheduleAnyway while SSD quota is exhausted vault-1 and vault-2 are stuck Pending because GCE quota (SSD_TOTAL_GB 500/500) prevents new nodes from provisioning. ScheduleAnyway lets them land in any zone that has capacity while the quota increase request is pending. Also adds ESO Workload Identity IAM bindings to Terraform state (previously applied out-of-band via gcloud; now tracked in cloud-sql.tf). --- servers/gcp/cloud-sql.tf | 18 ++++++++++++++++++ .../gcp/k8s/argocd-apps/vault-helm-gke.yaml | 2 +- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/servers/gcp/cloud-sql.tf b/servers/gcp/cloud-sql.tf index 12cefec..abd17ef 100644 --- a/servers/gcp/cloud-sql.tf +++ b/servers/gcp/cloud-sql.tf @@ -236,6 +236,24 @@ resource "google_secret_manager_secret_iam_member" "gitea_db_password_accessor" member = "serviceAccount:${google_service_account.gitea.email}" } +# ESO Workload Identity — allows the external-secrets controller SA on GKE +# to impersonate the gitea GCP SA for Secret Manager access. +resource "google_service_account_iam_member" "eso_gitea_wi" { + service_account_id = google_service_account.gitea.name + role = "roles/iam.workloadIdentityUser" + member = "serviceAccount:${var.project_id}.svc.id.goog[external-secrets/external-secrets]" + + depends_on = [google_container_cluster.neuron_platform] +} + +resource "google_service_account_iam_member" "eso_gitea_token_creator" { + service_account_id = google_service_account.gitea.name + role = "roles/iam.serviceAccountTokenCreator" + member = "serviceAccount:${var.project_id}.svc.id.goog[external-secrets/external-secrets]" + + depends_on = [google_container_cluster.neuron_platform] +} + output "gitea_service_account_email" { description = "Gitea GKE SA email — used in the Workload Identity annotation" value = google_service_account.gitea.email diff --git a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml index 8f2f051..019e0b1 100644 --- a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml +++ b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml @@ -90,7 +90,7 @@ spec: topologySpreadConstraints: - maxSkew: 1 topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: DoNotSchedule + whenUnsatisfiable: ScheduleAnyway labelSelector: matchLabels: app.kubernetes.io/name: vault