fix(gitea-gke): configure ESO SecretStore to use workload identity with gitea SA

2026-05-04 22:05:01 -05:00
parent 9252b069a2
commit 8592a1ed74
1 changed files with 9 additions and 2 deletions
@@ -16,8 +16,15 @@ spec:
  provider:
    gcpsm:
      projectID: neuron-785695
-      # Workload Identity is used automatically — no explicit auth needed
-      # when the pod's ServiceAccount has the iam.gke.io/gcp-service-account annotation.
+      # Workload Identity — ESO impersonates the gitea-gke GCP SA to access
+      # Secret Manager. The gitea SA has secretAccessor on gitea-db-password.
+      auth:
+        workloadIdentity:
+          clusterLocation: us-central1
+          clusterName: neuron-platform
+          serviceAccountRef:
+            name: gitea
+            namespace: gitea
 ---
 # gitea-db — Gitea database password, pulled from GCP Secret Manager.
 # The Secret Manager secret "gitea-database-url" stores the full DSN, but we