Step 3 - Enable your GKE cluster to access Secrets, either via Secrets Manager or Kubernetes Secrets

Create the following service account:

4 - Managed Identity - Create Service Account

• Create Service Account

 gcloud iam service-accounts create external-secrets-sa --display-name="External Secrets Service Account"

• Grant permissions to the newly created service account

gcloud projects add-iam-policy-binding [project_id] \
  --member="serviceAccount:external-secrets-sa@[project_id].iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

• Generate a key file from the service account created in the previous step above

gcloud iam service-accounts keys create keyfile.json \
  --iam-account="external-secrets-sa@[project_id].iam.gserviceaccount.com"

Note: the Secret below [gcp-secret] will be used during step 7 to install cdrplatform-external-secrets

• Create a Kubernetes Secrets from the contents of the key file created above

kubectl create secret generic gcp-secret --from-file=keyfile.json