solutions/core-landing-zone/namespaces/networking.yaml [18:86]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMServiceAccount
metadata:
  name: networking-sa
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  # AC-3(7), AC-3, AC-16(2)
  displayName: networking-sa
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: networking-sa-networkadmin-permissions
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Folder
    external: "123456789012" # kpt-set: ${lz-folder-id}
  # AC-1, AC-3(7), AC-3, AC-16(2)
  role: roles/compute.networkAdmin
  member: "serviceAccount:networking-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:networking-sa@${management-project-id}.iam.gserviceaccount.com
---
# Grant GCP role Security Admin to GCP SA
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: networking-sa-security-permissions
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  # AC-1, AC-3(7), AC-3, AC-16(2)
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Folder
    external: "123456789012" # kpt-set: ${lz-folder-id}
  role: roles/compute.securityAdmin
  member: "serviceAccount:networking-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:networking-sa@${management-project-id}.iam.gserviceaccount.com
---
# Grant GCP role DNS Admin to GCP SA
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: networking-sa-dns-permissions
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  # AC-1, AC-3(7), AC-3, AC-16(2)
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Folder
    external: "123456789012" # kpt-set: ${lz-folder-id}
  role: roles/dns.admin
  member: "serviceAccount:networking-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:networking-sa@${management-project-id}.iam.gserviceaccount.com
---
# Grant GCP role ACM Admin to networking GCP SA
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



solutions/legacy/landing-zone-v2/namespaces/networking.yaml [17:83]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMServiceAccount
metadata:
  name: networking-sa
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  displayName: networking-sa
---
# Grant GCP role Network Admin to GCP SA
# AC-3(7) - RBAC role to account with required permissions for networking administration
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: networking-sa-networkadmin-permissions
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Folder
    external: "123456789012" # kpt-set: ${lz-folder-id}
  role: roles/compute.networkAdmin
  member: "serviceAccount:networking-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:networking-sa@${management-project-id}.iam.gserviceaccount.com
---
# Grant GCP role Security Admin to GCP SA
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: networking-sa-security-permissions
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Folder
    external: "123456789012" # kpt-set: ${lz-folder-id}
  role: roles/compute.securityAdmin
  member: "serviceAccount:networking-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:networking-sa@${management-project-id}.iam.gserviceaccount.com
---
# Grant GCP role DNS Admin to GCP SA
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: networking-sa-dns-permissions
  namespace: config-control # kpt-set: ${management-namespace}
  annotations:
    cnrm.cloud.google.com/project-id: management-project-id # kpt-set: ${management-project-id}
    cnrm.cloud.google.com/ignore-clusterless: "true"
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Folder
    external: "123456789012" # kpt-set: ${lz-folder-id}
  role: roles/dns.admin
  member: "serviceAccount:networking-sa@management-project-id.iam.gserviceaccount.com" # kpt-set: serviceAccount:networking-sa@${management-project-id}.iam.gserviceaccount.com
---
# Grant GCP role ACM Admin to GCP SA
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



