# External Secret Operator GCP SecretStore

This is the ESO SecretStore using GCP Secret Manager.

## Prerequisite

The GKE cluster must have workload identity enabled.

## Setup

The setup steps are already automated by Pulumi. Below are just a demo manual setup steps.

1. Create a GCP Service Account (GSA)

``` shell
gcloud iam service-accounts create tennix-eso --description="Test External Secret Operator" --display-name="tennix-eso"
```

2. Grant permissions to GSA

``` shell
gcloud projects add-iam-policy-binding pingcap-gardener --member="serviceAccount:tennix-eso@pingcap-gardener.iam.gserviceaccount.com" --role=roles/secretmanager.secretAccessor
gcloud projects add-iam-policy-binding pingcap-gardener --member="serviceAccount:tennix-eso@pingcap-gardener.iam.gserviceaccount.com" --role=roles/iam.serviceAccountTokenCreator
```

3. Allow Kubernetes Service Account (KSA) to impersonate KSA

``` shell
gcloud iam service-accounts add-iam-policy-binding tennix-eso@pingcap-gardener.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:pingcap-gardener.svc.id.goog[external-secrets/es]" --project pingcap-gardener
```