apiVersion: v1
kind: Secret
metadata:
  name: gcs-credentials
  namespace: retour
type: Opaque
stringData:
  service-account-json: |
    {
      "type": "service_account",
      "project_id": "your-project"
    }
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: gcs-production
  namespace: retour
spec:
  type: gcs
  description: "Production Google Cloud Storage bucket"
  gcs:
    bucket: retour-backups
    secretRef:
      name: gcs-credentials
      keys:
        serviceAccountKey: service-account-json