|
|
@@ -4181,12 +4181,12 @@
|
|
|
<p>For example, the following CLI call grants the Kubernetes service account access to a secret <code>demo-secret</code>:</p>
|
|
|
<div class="highlight"><pre><span></span><code>gcloud<span class="w"> </span>secrets<span class="w"> </span>add-iam-policy-binding<span class="w"> </span>demo-secret<span class="w"> </span><span class="se">\</span>
|
|
|
<span class="w"> </span>--project<span class="o">=</span><span class="nv">$PROJECT_ID</span><span class="w"> </span><span class="se">\</span>
|
|
|
-<span class="w"> </span>--role<span class="o">=</span><span class="s2">"roles/secretmanager.secretAccessor"</span>
|
|
|
+<span class="w"> </span>--role<span class="o">=</span><span class="s2">"roles/secretmanager.secretAccessor"</span><span class="w"> </span><span class="se">\</span>
|
|
|
<span class="w"> </span>--member<span class="o">=</span><span class="s2">"principal://iam.googleapis.com/projects/</span><span class="si">${</span><span class="nv">PROJECT_NUMBER</span><span class="si">}</span><span class="s2">/locations/global/workloadIdentityPools/</span><span class="si">${</span><span class="nv">PROJECT_ID</span><span class="si">}</span><span class="s2">.svc.id.goog/subject/ns/</span><span class="si">${</span><span class="nv">K8S_NAMESPACE</span><span class="si">}</span><span class="s2">/sa/</span><span class="si">${</span><span class="nv">K8S_SA</span><span class="si">}</span><span class="s2">"</span>
|
|
|
</code></pre></div>
|
|
|
<p>You can also grant the Kubernetes service account access to <em>all</em> secrets in a GCP project:</p>
|
|
|
-<div class="highlight"><pre><span></span><code>gcloud<span class="w"> </span>project<span class="w"> </span>add-iam-policy-binding<span class="w"> </span><span class="nv">$PROJECT_ID</span><span class="w"> </span><span class="se">\</span>
|
|
|
-<span class="w"> </span>--role<span class="o">=</span><span class="s2">"roles/secretmanager.secretAccessor"</span>
|
|
|
+<div class="highlight"><pre><span></span><code>gcloud<span class="w"> </span>projects<span class="w"> </span>add-iam-policy-binding<span class="w"> </span><span class="nv">$PROJECT_ID</span><span class="w"> </span><span class="se">\</span>
|
|
|
+<span class="w"> </span>--role<span class="o">=</span><span class="s2">"roles/secretmanager.secretAccessor"</span><span class="w"> </span><span class="se">\</span>
|
|
|
<span class="w"> </span>--member<span class="o">=</span><span class="s2">"principal://iam.googleapis.com/projects/</span><span class="si">${</span><span class="nv">PROJECT_NUMBER</span><span class="si">}</span><span class="s2">/locations/global/workloadIdentityPools/</span><span class="si">${</span><span class="nv">PROJECT_ID</span><span class="si">}</span><span class="s2">.svc.id.goog/subject/ns/</span><span class="si">${</span><span class="nv">K8S_NAMESPACE</span><span class="si">}</span><span class="s2">/sa/</span><span class="si">${</span><span class="nv">K8S_SA</span><span class="si">}</span><span class="s2">"</span>
|
|
|
</code></pre></div>
|
|
|
<p>Note that this allows anyone who can create <code>ExternalSecret</code> resources referencing a <code>SecretStore</code> instance using this service account access to all secrets in the project.</p>
|