From 47dd844da65ca1f991a241692d7c1cd62a09ab7b Mon Sep 17 00:00:00 2001
From: Vaibhav Pathak <vaibhav.pathak@Vaibhavs-MacBook-Air.local>
Date: Fri, 16 Jan 2026 17:06:00 +0530
Subject: [PATCH] Update namespace to argo-workflows and integrate with
 Terraform

---
 .../cluster-secret-store.yaml                 | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 environment-provisioner/cluster-secret-store.yaml

diff --git a/environment-provisioner/cluster-secret-store.yaml b/environment-provisioner/cluster-secret-store.yaml
new file mode 100644
index 0000000..a6b5cf7
--- /dev/null
+++ b/environment-provisioner/cluster-secret-store.yaml
@@ -0,0 +1,23 @@
+---
+# ClusterSecretStore for GCP Secret Manager
+# Uses Workload Identity for authentication (recommended for GKE)
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: gcpsm-secret-store
+spec:
+  provider:
+    gcpsm:
+      # GCP Project ID where secrets are stored
+      projectID: prj-onlinesales-test-framework
+      # Authentication via Workload Identity
+      # The external-secrets controller ServiceAccount must be annotated with:
+      # iam.gke.io/gcp-service-account: <GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com
+      auth:
+        workloadIdentity:
+          clusterLocation: asia-south1
+          clusterName: backstage-cluster
+          clusterProjectID: prj-onlinesales-test-framework
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets-system