catalog/landing-zone-lite/namespaces/hierarchy.yaml [33:48]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "123456789012" # kpt-set: ${org-id}
  role: roles/resourcemanager.folderAdmin
  member: "serviceAccount:hierarchy-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:hierarchy-sa@${management-project-id}.iam.gserviceaccount.com
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: hierarchy-sa-workload-identity-binding
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



catalog/landing-zone/namespaces/hierarchy.yaml [33:48]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "123456789012" # kpt-set: ${org-id}
  role: roles/resourcemanager.folderAdmin
  member: "serviceAccount:hierarchy-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:hierarchy-sa@${management-project-id}.iam.gserviceaccount.com
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: hierarchy-sa-workload-identity-binding
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



