catalog/landing-zone-lite/namespaces/hierarchy.yaml [50:91]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    name: hierarchy-sa
    apiVersion: iam.cnrm.cloud.google.com/v1beta1
    kind: IAMServiceAccount
  bindings:
    - role: roles/iam.workloadIdentityUser
      members:
        - member: serviceAccount:management-project-id.svc.id.goog[cnrm-system/cnrm-controller-manager-hierarchy] # kpt-set: serviceAccount:${management-project-id}.svc.id.goog[cnrm-system/cnrm-controller-manager-hierarchy]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: allow-resource-reference-from-hierarchy
  namespace: hierarchy
  annotations:
    cnrm.cloud.google.com/ignore-clusterless: "true"
roleRef:
  name: cnrm-viewer
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
  - name: cnrm-controller-manager-projects
    namespace: cnrm-system
    kind: ServiceAccount
---
apiVersion: v1
kind: Namespace
metadata:
  name: hierarchy
  annotations:
    cnrm.cloud.google.com/organization-id: "123456789012" # kpt-set: ${org-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
---
apiVersion: core.cnrm.cloud.google.com/v1beta1
kind: ConfigConnectorContext
metadata:
  name: configconnectorcontext.core.cnrm.cloud.google.com
  namespace: hierarchy
  annotations:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



catalog/landing-zone/namespaces/hierarchy.yaml [50:91]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    name: hierarchy-sa
    apiVersion: iam.cnrm.cloud.google.com/v1beta1
    kind: IAMServiceAccount
  bindings:
    - role: roles/iam.workloadIdentityUser
      members:
        - member: serviceAccount:management-project-id.svc.id.goog[cnrm-system/cnrm-controller-manager-hierarchy] # kpt-set: serviceAccount:${management-project-id}.svc.id.goog[cnrm-system/cnrm-controller-manager-hierarchy]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: allow-resource-reference-from-hierarchy
  namespace: hierarchy
  annotations:
    cnrm.cloud.google.com/ignore-clusterless: "true"
roleRef:
  name: cnrm-viewer
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
  - name: cnrm-controller-manager-projects
    namespace: cnrm-system
    kind: ServiceAccount
---
apiVersion: v1
kind: Namespace
metadata:
  name: hierarchy
  annotations:
    cnrm.cloud.google.com/organization-id: "123456789012" # kpt-set: ${org-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
---
apiVersion: core.cnrm.cloud.google.com/v1beta1
kind: ConfigConnectorContext
metadata:
  name: configconnectorcontext.core.cnrm.cloud.google.com
  namespace: hierarchy
  annotations:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



