do-backup.bash

#!/bin/zsh

gsutil mb gs://argocd-backup

gcloud iam service-accounts create argocd-backup \
    --description="argocd-backup utils" \
    --display-name="argocd-backup"

gsutil iam ch serviceAccount:argocd-backup@<PROJECT_KEY>.iam.gserviceaccount.com:objectAdmin gs://argocd-backup

gcloud iam service-accounts add-iam-policy-binding \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:<PROJECT_KEY>.svc.id.goog[utils/stg-argocd-backup-eu-west1]" \
  argocd-backup@<PROJECT_KEY>.iam.gserviceaccount.com

# TEST KSA to GSA -> gsutil ls gs://backup-bucket #should work
kubectl run -it \
  --image google/cloud-sdk:slim \
  --serviceaccount <KSA_NAME> \
  --namespace utils \
  workload-identity-test