-
Notifications
You must be signed in to change notification settings - Fork 2
/
gcp.yml
60 lines (58 loc) · 1.79 KB
/
gcp.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# export PROJECT_ID="your-project-id"
# export SA="secrets-init-sa"
# export SECRET_ID="myapp"
#
# gcloud iam service-accounts create $SA --display-name "$SA"
# gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:$SA@$PROJECT_ID.iam.gserviceaccount.com --role roles/secretmanager.secretAccessor
# gcloud projects add-iam-policy-binding $PROJECT_ID --member serviceAccount:$SA@$PROJECT_ID.iam.gserviceaccount.com --role roles/secretmanager.viewer
#
# gcloud iam service-accounts keys create gcp_credentials.json --iam-account=$SA@$PROJECT_ID.iam.gserviceaccount.com
# kubectl create secret generic gcp-credentials --from-file=gcp_credentials.json
#
# gcloud secrets create $SECRET_ID --replication-policy="automatic"
# gcloud secrets versions add $SECRET_ID --data-file="secret-data-file.json"
#
# cat gcp.yml | sed "s/<YOUR_PROJECT_ID>/$PROJECT_ID/g" | kubectl apply -f -
#
apiVersion: v1
kind: Pod
metadata:
name: secrets-init-gcp
spec:
containers:
- name: busybox
image: busybox
command:
- /bin/sh
- -c
- |
cat /secrets/init/env
tail -f /dev/null
volumeMounts:
- mountPath: /secrets/init
name: secrets-init
initContainers:
- name: secrets-init
image: leocomelli/secrets-init:latest
imagePullPolicy: Always
args:
- "--project=<YOUR_PROJECT_ID>"
- "--filter=^myapp*"
- "-data-parser=json"
- "-output=/secrets/init/env"
env:
- name: GOOGLE_APPLICATION_CREDENTIALS
value: /etc/gcp/gcp_credentials.json
volumeMounts:
- mountPath: /secrets/init
name: secrets-init
- name: gcp-credentials-volume
mountPath: /etc/gcp
readOnly: true
volumes:
- name: secrets-init
emptyDir:
medium: Memory
- name: gcp-credentials-volume
secret:
secretName: gcp-credentials