Will Anderson
69 lines
3.0 KiB
Terraform
69 lines
3.0 KiB
Terraform
# ── DocuSeal GKE service account and Workload Identity ───────────────────────
|
|
# DocuSeal runs in the `docuseal` namespace on GKE. It accesses GCP Secret
|
|
# Manager via Workload Identity — no JSON key files.
|
|
#
|
|
# Secret flow: Vault → GCP Secret Manager → ExternalSecret → k8s Secret → pod
|
|
|
|
resource "google_service_account" "docuseal_gke" {
|
|
account_id = "docuseal-gke"
|
|
display_name = "DocuSeal GKE"
|
|
description = "Identity for DocuSeal pod on GKE. Accesses Secret Manager via Workload Identity."
|
|
project = var.project_id
|
|
}
|
|
|
|
# ── Secret Manager access ─────────────────────────────────────────────────────
|
|
|
|
resource "google_secret_manager_secret_iam_member" "docuseal_secret_key_base" {
|
|
project = var.project_id
|
|
secret_id = "docuseal-secret-key-base"
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.docuseal_gke.email}"
|
|
}
|
|
|
|
resource "google_secret_manager_secret_iam_member" "docuseal_smtp_host" {
|
|
project = var.project_id
|
|
secret_id = "docuseal-smtp-host"
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.docuseal_gke.email}"
|
|
}
|
|
|
|
resource "google_secret_manager_secret_iam_member" "docuseal_smtp_port" {
|
|
project = var.project_id
|
|
secret_id = "docuseal-smtp-port"
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.docuseal_gke.email}"
|
|
}
|
|
|
|
resource "google_secret_manager_secret_iam_member" "docuseal_smtp_username" {
|
|
project = var.project_id
|
|
secret_id = "docuseal-smtp-username"
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.docuseal_gke.email}"
|
|
}
|
|
|
|
resource "google_secret_manager_secret_iam_member" "docuseal_smtp_password" {
|
|
project = var.project_id
|
|
secret_id = "docuseal-smtp-password"
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.docuseal_gke.email}"
|
|
}
|
|
|
|
resource "google_secret_manager_secret_iam_member" "docuseal_smtp_from" {
|
|
project = var.project_id
|
|
secret_id = "docuseal-smtp-from"
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.docuseal_gke.email}"
|
|
}
|
|
|
|
# ── Workload Identity binding ─────────────────────────────────────────────────
|
|
# The k8s SA `docuseal` in the `docuseal` namespace can impersonate this GCP SA.
|
|
# ESO uses this to authenticate to Secret Manager without a key file.
|
|
|
|
resource "google_service_account_iam_member" "docuseal_workload_identity" {
|
|
service_account_id = google_service_account.docuseal_gke.name
|
|
role = "roles/iam.workloadIdentityUser"
|
|
member = "serviceAccount:${var.project_id}.svc.id.goog[docuseal/docuseal]"
|
|
|
|
depends_on = [google_container_cluster.neuron_platform]
|
|
}
|