refactor: add service account

cloudbuild.yaml

@@ -116,6 +116,8 @@ steps:
       - cloud_sql.env.cloudsql_connection_instance=${_CLOUDSQL_INSTANCE_CONNECTION_NAME}
       - --set
       - django.configmap.config_name=${_CONFIGMAP_FILE}
+      - --set
+      - common.service_account_key=${_IAM_SERVICE_ACCOUNT_KEY}
       - .
 
   # Update essential Variables and Deploy to cluster
@@ -128,6 +130,7 @@ steps:
       - upgrade
       - --install
       - ${_APP_NAME}-${_DEPLOYMENT_TYPE}
+      - --debug
       - --namespace=${_NAMESPACE}
       - --values
       - values.yaml
@@ -153,6 +156,8 @@ steps:
       - cloud_sql.env.cloudsql_connection_instance=${_CLOUDSQL_INSTANCE_CONNECTION_NAME}
       - --set
       - django.configmap.config_name=${_CONFIGMAP_FILE}
+      - --set
+      - common.service_account_key=${_IAM_SERVICE_ACCOUNT_KEY}
       - .
 
 images:

deploy/templates/django/deployment.yaml

@@ -28,7 +28,7 @@ spec:
                 name: {{ .Values.django.configmap.config_name }}
           volumeMounts:
             - name: env-var-vol
-              mountPath: /secrets/environment_variables
+              mountPath: /secrets
               readOnly: true
 
       volumes:

deploy/templates/pg-bouncer/deployment.yaml

@@ -34,13 +34,13 @@ spec:
             - "--structured-logs"
             - "--port=5432"
             - "{{ .Values.cloud_sql.env.cloudsql_connection_instance }}"
-            - "--credentials-file=/secrets/service_account_secrets/service_account.json"
+            - "--credentials-file=/secrets/{{ .Values.common.service_account_name }}/service_account.json"
           securityContext:
             runAsNonRoot: true
-          volumeMounts:
-            - name: sa-secret-vol
-              mountPath: /secrets/service_account_secrets
-              readOnly: true
+#          volumeMounts:
+#            - name: sa-secret-vol
+#              mountPath: /secrets/iam-service-account-key
+#              readOnly: true
       volumes:
         - name: user-config
           configMap:
@@ -50,6 +50,6 @@ spec:
           configMap:
             name: {{ .Values.pg_bouncer.app_name }}-pgb-config
 
-        - name: sa-secret-vol
-          secret:
-            secretName: {{ .Values.namespace }}-sa-secrets
+#        - name: sa-secret-vol
+#          secret:
+#            secretName: {{ .Values.namespace }}-sa-secrets

deploy/templates/service_account/secrets.yml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.common.service_account_name }}
+  namespace: {{ .Values.namespace }}
+type: Opaque
+data:
+  # base64 -w 0 /path/to/sa_key.json
+  service_account.json: {{ .Values.common.service_account_key }}
+
+---
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: mount-service-account
+  namespace: {{ .Values.namespace }}
+spec:
+  containers:
+  - name: alpine-container
+    image: alpine:latest
+    command: ["sleep", "3600"]  # Sleep to keep the pod running
+    volumeMounts:
+    - name: service-account-vol
+      mountPath: "/secrets/{{ .Values.common.service_account_name }}"
+      readOnly: true
+  volumes:
+  - name: service-account-vol
+    secret:
+      secretName: {{ .Values.namespace }}-sa-secrets

deploy/values.yaml

@@ -1,5 +1,8 @@
 namespace: cluster_namespace
 
+common:
+  service_account_key: "base64_encoded_sa_key"
+  service_account_name: "iam-service-account-key"
 django:
   app_name: django
   replica_count: 2