Skip to main content

Storage, Messaging, Cache & Secrets

Project-scoped resources and the accessControl blocks that grant applications least-privilege access to them.

Bucket (Cloud Storage)​

# .../project/login-svc/bucket/receipts.yaml
apiVersion: lowops.manifests.v1
kind: Bucket
metadata:
  name: receipts
  project: login-svc
  environment: prod
  organizational-unit: retail-banking
  organization: fincorp
spec:
  region: us-central1
  storageClass: STANDARD   # STANDARD | NEARLINE | COLDLINE | ARCHIVE

Grant an application access (in its Application spec):

spec:
  accessControl:
    buckets:
      - name: receipts
        permission: WRITE        # READ_ONLY | WRITE
        subPath: "processed/"    # optional: restrict to a prefix
        # mountPath: /data/receipts   # optional: mount as a filesystem

PubSub topic​

# .../project/login-svc/pubsub/order-events.yaml
apiVersion: lowops.manifests.v1
kind: PubSub
metadata:
  name: order-events
  project: login-svc
  environment: prod
  organizational-unit: retail-banking
  organization: fincorp
spec:
  description: "Emitted when an order changes state."
  messageRetentionDurationSeconds: 604800   # 7 days

Grant publish/subscribe access (in each Application spec):

spec:
  accessControl:
    pubsub:
      publishTo:
        - order-events         # grants roles/pubsub.publisher
      subscribeTo:
        - order-events         # grants roles/pubsub.subscriber

Redis cache​

# .../project/login-svc/redis/session-cache.yaml
apiVersion: lowops.manifests.v1
kind: Redis
metadata:
  name: session-cache
  project: login-svc
  environment: prod
  organizational-unit: retail-banking
  organization: fincorp
spec:
  description: "Session store for auth tokens."
  enabled: true
  memorySizeGb: 4

Secret​

The manifest declares the secret container; the value is added out-of-band in Secret Manager (never committed to Git).

# .../project/login-svc/secret/partner-api-key.yaml
apiVersion: lowops.manifests.v1
kind: Secret
metadata:
  name: partner-api-key
  project: login-svc
  environment: prod
  organizational-unit: retail-banking
  organization: fincorp
spec:
  description: "API key for the external partner integration."

Grant an application access (map keyed by the Secret manifest name):

spec:
  accessControl:
    secrets:
      partner-api-key:
        envVar: PARTNER_API_KEY    # inject as this env var (or filePath for a file mount)
        # version: latest          # optional: pin a version