setup.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: {namespace}
  labels:
    name: {namespace}
    env: dev
    team: {namespace}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: externaldns-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-ex@{project_id}.iam.gserviceaccount.com
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: boot-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-jb@{project_id}.iam.gserviceaccount.com
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kaniko-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-ko@{project_id}.iam.gserviceaccount.com
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: storage-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-st@{project_id}.iam.gserviceaccount.com
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-tk@{project_id}.iam.gserviceaccount.com
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-vt@{project_id}.iam.gserviceaccount.com
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: velero-sa
  namespace: {namespace}
  annotations:
    iam.gke.io/gcp-service-account: {cluster_name}-vo@{project_id}.iam.gserviceaccount.com
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jx-boot
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: boot-sa
  namespace: {namespace}