will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

infra: wire GKE cluster endpoint and fix gitea SA account_id

Browse Source 
- Replace GKE_CLUSTER_ENDPOINT placeholder with real endpoint (34.63.89.52)
  in all three Argo CD Application manifests
- Fix gitea GCP SA account_id from 'gitea' (5 chars, too short) to 'gitea-gke'
  to satisfy GCP's 6-30 char constraint
- Update serviceaccount.yaml annotation to match new SA email (gitea-gke@...)
This commit is contained in:
Will Anderson
2026-05-04 21:56:06 -05:00
parent 4ef5e99f31
commit b572f5720b
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/gcp/cloud-sql.tf
+1 -1
View File
@@ -174,7 +174,7 @@ resource "google_sql_user" "gitea" {
# ── Gitea service account (for Workload Identity → Cloud SQL) ───────────────── # ── Gitea service account (for Workload Identity → Cloud SQL) ─────────────────
resource "google_service_account" "gitea" { resource "google_service_account" "gitea" {
account_id = "gitea" account_id = "gitea-gke"
display_name = "Gitea GKE SA" display_name = "Gitea GKE SA"
description = "Service account for the Gitea pod on GKE. Used by the Cloud SQL Auth Proxy sidecar via Workload Identity." description = "Service account for the Gitea pod on GKE. Used by the Cloud SQL Auth Proxy sidecar via Workload Identity."
project = var.project_id project = var.project_id
servers/gcp/k8s/argocd-apps/gitea-gke.yaml
+1 -1
View File
@@ -27,7 +27,7 @@ spec:
destination: destination:
# Replace GKE_CLUSTER_ENDPOINT after `terraform apply`: # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
# terraform -chdir=servers/gcp output -raw gke_cluster_endpoint # terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
server: https://GKE_CLUSTER_ENDPOINT server: https://34.63.89.52
namespace: gitea namespace: gitea
syncPolicy: syncPolicy:
automated: automated:
servers/gcp/k8s/argocd-apps/vault-gke.yaml
+1 -1
View File
@@ -22,7 +22,7 @@ spec:
destination: destination:
# Replace GKE_CLUSTER_ENDPOINT after `terraform apply`: # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
# terraform -chdir=servers/gcp output -raw gke_cluster_endpoint # terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
server: https://GKE_CLUSTER_ENDPOINT server: https://34.63.89.52
namespace: vault namespace: vault
syncPolicy: syncPolicy:
automated: automated:
servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
+1 -1
View File
@@ -142,7 +142,7 @@ spec:
destination: destination:
# Replace GKE_CLUSTER_ENDPOINT after `terraform apply`: # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
# terraform -chdir=servers/gcp output -raw gke_cluster_endpoint # terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
server: https://GKE_CLUSTER_ENDPOINT server: https://34.63.89.52
namespace: vault namespace: vault
syncPolicy: syncPolicy:
automated: automated:
servers/gcp/k8s/gitea/serviceaccount.yaml
+1 -1
View File
@@ -7,4 +7,4 @@ metadata:
# Workload Identity — allows the Cloud SQL Auth Proxy sidecar to authenticate # Workload Identity — allows the Cloud SQL Auth Proxy sidecar to authenticate
# to Cloud SQL as the gitea GCP SA without a JSON key file. # to Cloud SQL as the gitea GCP SA without a JSON key file.
# The GCP SA binding is in servers/gcp/gke.tf (gitea_workload_identity). # The GCP SA binding is in servers/gcp/gke.tf (gitea_workload_identity).
iam.gke.io/gcp-service-account: gitea@neuron-785695.iam.gserviceaccount.com iam.gke.io/gcp-service-account: gitea-gke@neuron-785695.iam.gserviceaccount.com