chore: Add bucket rw iam binding

examples/basic/main.tf

@@ -24,4 +24,9 @@ module "ctrlplane" {
   source    = "../../"
   namespace = var.namespace
   domains   = ["example.com"]
+  fqdn      = "example.com"
+  google_auth = {
+    client_id     = "1234567890"
+    client_secret = "1234567890"
+  }
 }

main.tf

@@ -72,7 +72,9 @@ module "service_accounts" {
   source    = "./modules/service_accounts"
   namespace = var.namespace
 
-  depends_on = [module.gke]
+  bucket_name = module.storage.bucket_name
+
+  depends_on = [module.gke, module.storage]
 }
 
 resource "google_compute_global_address" "this" {

modules/service_accounts/main.tf

@@ -19,6 +19,7 @@ locals {
     "serviceAccount:${local.project_id}.svc.id.goog[${local.gke_namespace}/ctrlplane-migrations]",
     "serviceAccount:${local.project_id}.svc.id.goog[${local.gke_namespace}/ctrlplane-event-worker]",
     "serviceAccount:${local.project_id}.svc.id.goog[${local.gke_namespace}/ctrlplane-event-queue]",
+    "serviceAccount:${local.project_id}.svc.id.goog[${local.gke_namespace}/ctrlplane-workspace-engine]",
   ]
 }
 
@@ -59,3 +60,9 @@ resource "google_project_iam_member" "gke_sa_token_creator" {
   role    = "roles/iam.serviceAccountTokenCreator"
   member  = local.sa_member
 }
+
+resource "google_storage_bucket_iam_member" "gke_sa_bucket_rw" {
+  bucket = var.bucket_name
+  role   = "roles/storage.objectAdmin"
+  member = local.sa_member
+}

modules/service_accounts/variables.tf

@@ -2,3 +2,8 @@ variable "namespace" {
   description = "Namespace for the service accounts"
   type        = string
 }
+
+variable "bucket_name" {
+  description = "The GCS bucket name to grant access to"
+  type        = string
+}

modules/storage/outputs.tf

@@ -0,0 +1,4 @@
+output "bucket_name" {
+  value       = google_storage_bucket.this.name
+  description = "The name of the bucket."
+}