const name = 'ciInfrastructure'

export const ciInfrastructure = new gcp.serviceAccount.Account(
  name,
  {
    project,
    accountId: 'ci-infrastructure',
    displayName: 'CI infrastructure account',
  },
  { protect },
)

bindToIAMRole(`${name}ClusterAdmin`, ciInfrastructure, {
  project,
  role: 'roles/container.clusterAdmin',
})
// for deploying cluster-wide resources e.g. traefik, cert-manager
bindToIAMRole(`${name}ContainerDeveloper`, ciInfrastructure, {
  project,
  role: 'roles/container.developer',
})