---
# ClusterSecretStore for GCP Secret Manager
# Uses Workload Identity for authentication (recommended for GKE)
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: gcpsm-secret-store
spec:
  provider:
    gcpsm:
      # GCP Project ID where secrets are stored
      projectID: prj-onlinesales-test-framework
      # Authentication via Workload Identity
      # The external-secrets controller ServiceAccount must be annotated with:
      # iam.gke.io/gcp-service-account: <GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com
      auth:
        workloadIdentity:
          clusterLocation: asia-south1
          clusterName: backstage-cluster
          clusterProjectID: prj-onlinesales-test-framework
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets-system