From b572f5720b54896469f93e07618ea04b3c50dcff Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Mon, 4 May 2026 21:56:06 -0500 Subject: [PATCH] infra: wire GKE cluster endpoint and fix gitea SA account_id - Replace GKE_CLUSTER_ENDPOINT placeholder with real endpoint (34.63.89.52) in all three Argo CD Application manifests - Fix gitea GCP SA account_id from 'gitea' (5 chars, too short) to 'gitea-gke' to satisfy GCP's 6-30 char constraint - Update serviceaccount.yaml annotation to match new SA email (gitea-gke@...) --- servers/gcp/cloud-sql.tf | 2 +- servers/gcp/k8s/argocd-apps/gitea-gke.yaml | 2 +- servers/gcp/k8s/argocd-apps/vault-gke.yaml | 2 +- servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml | 2 +- servers/gcp/k8s/gitea/serviceaccount.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/servers/gcp/cloud-sql.tf b/servers/gcp/cloud-sql.tf index 9947074..12cefec 100644 --- a/servers/gcp/cloud-sql.tf +++ b/servers/gcp/cloud-sql.tf @@ -174,7 +174,7 @@ resource "google_sql_user" "gitea" { # ── Gitea service account (for Workload Identity → Cloud SQL) ───────────────── resource "google_service_account" "gitea" { - account_id = "gitea" + account_id = "gitea-gke" display_name = "Gitea GKE SA" description = "Service account for the Gitea pod on GKE. Used by the Cloud SQL Auth Proxy sidecar via Workload Identity." project = var.project_id diff --git a/servers/gcp/k8s/argocd-apps/gitea-gke.yaml b/servers/gcp/k8s/argocd-apps/gitea-gke.yaml index 952e6b3..cb44b75 100644 --- a/servers/gcp/k8s/argocd-apps/gitea-gke.yaml +++ b/servers/gcp/k8s/argocd-apps/gitea-gke.yaml @@ -27,7 +27,7 @@ spec: destination: # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`: # terraform -chdir=servers/gcp output -raw gke_cluster_endpoint - server: https://GKE_CLUSTER_ENDPOINT + server: https://34.63.89.52 namespace: gitea syncPolicy: automated: diff --git a/servers/gcp/k8s/argocd-apps/vault-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-gke.yaml index c4caec6..db8e7a9 100644 --- a/servers/gcp/k8s/argocd-apps/vault-gke.yaml +++ b/servers/gcp/k8s/argocd-apps/vault-gke.yaml @@ -22,7 +22,7 @@ spec: destination: # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`: # terraform -chdir=servers/gcp output -raw gke_cluster_endpoint - server: https://GKE_CLUSTER_ENDPOINT + server: https://34.63.89.52 namespace: vault syncPolicy: automated: diff --git a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml index 2a9fe69..46f4869 100644 --- a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml +++ b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml @@ -142,7 +142,7 @@ spec: destination: # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`: # terraform -chdir=servers/gcp output -raw gke_cluster_endpoint - server: https://GKE_CLUSTER_ENDPOINT + server: https://34.63.89.52 namespace: vault syncPolicy: automated: diff --git a/servers/gcp/k8s/gitea/serviceaccount.yaml b/servers/gcp/k8s/gitea/serviceaccount.yaml index a0956f1..d45c293 100644 --- a/servers/gcp/k8s/gitea/serviceaccount.yaml +++ b/servers/gcp/k8s/gitea/serviceaccount.yaml @@ -7,4 +7,4 @@ metadata: # Workload Identity — allows the Cloud SQL Auth Proxy sidecar to authenticate # to Cloud SQL as the gitea GCP SA without a JSON key file. # The GCP SA binding is in servers/gcp/gke.tf (gitea_workload_identity). - iam.gke.io/gcp-service-account: gitea@neuron-785695.iam.gserviceaccount.com + iam.gke.io/gcp-service-account: gitea-gke@neuron-785695.iam.gserviceaccount.com