# External Secret Operator GCP SecretStore

This is the ESO SecretStore using GCP Secret Manager.

## Prerequisite

The GKE cluster must have workload identity enabled.

## Setup

The setup steps can be automated by Pulumi or Terraform provision script.

1. Create a GCP Service Account (GSA)

``` shell
gcloud iam service-accounts create external-secret-operator --description="External Secret Operator" --display-name="external-secret-operator" --project pingcap-dbaas-build
```

2. Grant permissions to GSA

``` shell
gcloud projects add-iam-policy-binding pingcap-dbaas-build --member="serviceAccount:external-secret-operator@pingcap-dbaas-build.iam.gserviceaccount.com" --role=roles/secretmanager.secretAccessor
gcloud projects add-iam-policy-binding pingcap-dbaas-build --member="serviceAccount:external-secret-operator@pingcap-dbaas-build.iam.gserviceaccount.com" --role=roles/iam.serviceAccountTokenCreator
```

3. Allow Kubernetes Service Account (KSA) to impersonate KSA

``` shell
gcloud iam service-accounts add-iam-policy-binding external-secret-operator@pingcap-dbaas-build.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:pingcap-dbaas-build.svc.id.goog[external-secrets/es]" --project pingcap-dbaas-build
```