apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: demo-store
  namespace: demo
spec:
  provider:
    gcpsm:
      projectID: [PROJECT_ID]
      auth:
        workloadIdentity:
          clusterLocation: [CLUSTER_LOCATION]
          clusterName: [CLUSTER_NAME]
          serviceAccountRef:
            name: demo-secrets-sa
