add new secrets

apps/base/customer1/news_bot/analyst-cronjob.yaml

@@ -49,7 +49,7 @@ spec:
                 - name: DB_PASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: news-user-password
+                      name: news-app-password
                       key: password
               envFrom:
                 - configMapRef:

apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml

@@ -19,7 +19,7 @@ spec:
                 - name: DB_PASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: news-user-password
+                      name: news-app-password
                       key: password 
               envFrom:
                 - configMapRef:

apps/base/customer1/news_bot/kustomization.yaml

@@ -14,4 +14,5 @@ resources:
   - gemma-configmap.yaml
   - analyst-cronjob.yaml
   - ollama-storage.yaml
+  - news-app-password.yaml
 

apps/base/customer1/news_bot/news-app-password.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:d2MAWwaRAWBsz+/VNV46whVTqBY=,iv:B7Ho0E6Xkj9jQvUBM0EfwoMzdBKaS4l85KXkyO52xgM=,tag:WpdaN5bW9FQjpyMChTAR7w==,type:str]
+    username: ENC[AES256_GCM,data:ZofCHAydBukvd0NK,iv:QkEbrjtD1NTCZdVDbFZsKzC6rh4paPSSc/jRupOnl5s=,tag:T/aeQY13Gi5hOs9l8eXaIg==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: null
+    name: news-app-password
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMTd4bnRsdnRQeXJ0RXBv
+            a3I1RmVheWx4S3dCVzI2Z0tDRnI0U0EzUFVFCnlOaUpGOHNTYUtHZ1g2MmpRT1M3
+            YXJBUGFxWGNDUHlONFhpckt5QXV5MEUKLS0tIDdKeEpTSGdwQXZrUzRFWlQxZWtx
+            UEVZZzJRWjlmWFpLUUZnSVhxZWRsZUkKeEM9QZTc2dxD6JWJveid8yz9lBeTMsWy
+            3omHFX2Ej5XAcM9RemiGHwclp2UBL8++5JeJlnVTbvNn+IkeH3gu5g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-22T19:23:13Z"
+    mac: ENC[AES256_GCM,data:1Ddf5/F620muz4gDcGRaSAGFD4zKFyVEvc3uqPppG8NMdwMXhOrTMmkb2TXkpMcqdnt/sbX5hD9me+FHZ0yvttlf27uc/bI+RRoJDo9b3MJd6OkBB9YPTtPZ7WJXmBcfejPAHo8RSoM3Q9Y8EjbTxUBNfi7qLdMK/l3rW9lonhg=,iv:qQU5EhgkSuAdV0Rd9nr/c0wJhWgFK9IWSetLwfmA9Xs=,tag:7wSkcR8j6dBz+6WqSwIAWQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/base/customer1/news_bot/scraper-cronjob.yaml

@@ -17,11 +17,11 @@ spec:
             
             resources:
               requests:
-                memory: "500Mi"
-                cpu: "100m"
-              limits:
                 memory: "1Gi"
                 cpu: "500m"
+              limits:
+                memory: "2Gi"
+                cpu: "1000m"
             envFrom:
             - configMapRef:
                 name: scrapy-config
@@ -29,7 +29,7 @@ spec:
               - name: DB_PASSWORD
                 valueFrom:
                   secretKeyRef:
-                    name: news-user-password 
+                    name: news-app-password 
                     key: password 
             volumeMounts:
               - name: url-storage

apps/base/customer1/news_bot/telebot-cronjob.yaml

@@ -26,6 +26,6 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: news-user-password 
+                  name: news-app-password 
                   key: password
           restartPolicy: OnFailure

apps/base/customer1/pg-cluster-customer1.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: customer1
   
 spec:
+  serviceAccountName: cnpg-backup-sa
   managed:
     roles:
       - name: customer1
@@ -16,7 +17,7 @@ spec:
         ensure: present
         login: true 
         passwordSecret:
-          name: news-user-password
+          name: news-app-password
   instances: 3
   imageName: ghcr.io/cloudnative-pg/postgresql:15.2
   storage:
@@ -30,7 +31,7 @@ spec:
   serviceAccountTemplate:
     metadata:
       annotations:
-        iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com
+        iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com  
 
   backup:
     barmanObjectStore:

grafana-secrets.yaml

@@ -1,9 +1,24 @@
 apiVersion: v1
 data:
-  GRAFANA_ADMIN_PASSWD: UGV0dWsxazE=
+    GRAFANA_ADMIN_PASSWD: ENC[AES256_GCM,data:jxg51c5U2w6zgBXa,iv:nn2axEYen+kS0krlv2RXb2aHo29auu74QC5aHPmz6Nk=,tag:YUDr81JINm+oGYE5ESyDAQ==,type:str]
-  GRAFANA_ADMIN_USER: c2lyaXVz
+    GRAFANA_ADMIN_USER: ENC[AES256_GCM,data:p7Ul3yAh9pc=,iv:WquGgBBeN/q0X0grDxkutE9KeaB7dSNvGuV1AcXPByQ=,tag:bm3iPB2f8f3sPVhE8ig4XQ==,type:str]
 kind: Secret
 metadata:
-  creationTimestamp: null
+    creationTimestamp: null
-  name: grafana-secrets
+    name: grafana-secrets
-  namespace: customer1
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNM2ZZWFhtRFdNNUhBbTB0
+            MHFsRHFPTTBac3B1OTNYUEtUaTV1WlVYYlVjCktWc1BkZHNhYmRHRURDMVhIUXNZ
+            TWpKa1A0OGM0NnE1YUxNekJCTTRCclUKLS0tIEp1VUFmcUZyWURsRkJxOFFLUU9W
+            eUJIQjQ3aVVGQlBzNm0vdUprRlNrYmcKpPl8FMLi2Z/hDZcwrJvxp+KgE/k2bynp
+            aNbdattl09RorT1gm8WB2nzA6UJwFiZduRnwOus9W6GFV402Igf3Og==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-22T19:23:41Z"
+    mac: ENC[AES256_GCM,data:HB/FVs4vUpSh32qJqH70CYE7KfG1hU52e0qEF73iJChGsfoawahf1WYS3EQcKaQm6w6Q2AgE88TDwHhOLzns57jqM+1gkBoQfAb/P2qYuv2G9YDMsEQT8C8cSQsCRatCub4064i1exjv9/VM6vr5bcF7oz7bWKZBV7CeTdkwikQ=,iv:nE4w/WBk/eP//rscPUc/CdW6BKMpqd+clNtnwrSQrBU=,tag:OvApAtKsdgaZpzEv0Wwn/Q==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

grafanaSecrets1.yaml

@@ -1,9 +1,24 @@
 apiVersion: v1
 data:
-  grafana_admin_password: UGV0dWsxazE=
+    grafana_admin_password: ENC[AES256_GCM,data:orvxn/NU9HDUKFwP,iv:8dAUYfKSKX9wL6/CBiU60wLSkZebDOjk/y7IcrVIFXw=,tag:Lb4Eku8S6HNbEa8xInF8iw==,type:str]
-  grafana_admin_user: c2lyaXVz
+    grafana_admin_user: ENC[AES256_GCM,data:/DjABi9gI6M=,iv:fXl0qg1+a3n8GXWT+zk2ooUvfyMpp/yT8UzFsEtTmtQ=,tag:FAF6kwq0aW5TVasXOwQobA==,type:str]
 kind: Secret
 metadata:
-  creationTimestamp: null
+    creationTimestamp: null
-  name: grafana_secrets
+    name: grafana_secrets
-  namespace: customer1
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQkYwQjZVT3BqM0RLRCt4
+            eGY0aHRXYkJDQ1AzK1F5T0RuWFNVQVF5SWg4CkI0ckMrR01tcVVoU2c0SFZXTFJZ
+            ZitBMzUyQVNKMmtXNW1meFlUTy9VMFkKLS0tIEdaanlrVDBXWHd0dDZVdUlaZng0
+            RGhCNEQwaHd5QlFoRlBzR2swRVVQUG8K9ESwtVP7k8m4mwAdu5syks51uSzyv3xN
+            1ivdPU/Nzs3in1UNbdbg16PEGARrI2mh0DTHRCJcqFGyu3p92tqzww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-22T19:23:34Z"
+    mac: ENC[AES256_GCM,data:NmMC0PT3QehIOeyi8yJ5h+KmZrygURNUOGYyu0xn3wCZQLJ5ry3SA8zwkjIkwZiaHs//yHoC7Xf245yxvdxDdIvSVpGjarhknaTbXrJWh5t0IHjG6nnvKIWT+E955ix5tBHA8BF21Ha1SmbGIEbtRdQExPiaze9vUHYsS2fNhYo=,iv:sG2+8TSYcAqH9PzeD5RA6xRVdVwSjK99kZFKPIJ+R+U=,tag:DugXE1/ax2r55nXCD7vRHg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

modules/db-bucket.tf

@@ -40,3 +40,12 @@ resource "google_service_account_iam_binding" "workload_identity_binding" {
 output "gcp_sa_email" {
   value = google_service_account.cnpg_backup_sa.email
 }
+
+resource "google_service_account_iam_member" "token_creator_binding" {
+  service_account_id = google_service_account.cnpg_backup_sa.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  
+  # This allows the GSA to generate tokens for itself when called by the pod
+  member             = "serviceAccount:${google_service_account.cnpg_backup_sa.email}"
+}
+