Default shared_project to project_id for Kubernetes kubeconfig lookup

CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this action are recorded here. Versions follow semantic
 versioning; callers should normally use the maintained `v1` major tag.
 
+## v1.0.6 - 2026-08-29
+
+- Default `shared_project` to `project_id` so Kubernetes modules look up the
+  kubeconfig secret in the caller's own project unless told otherwise.
+- Document the `k8s-config-<cluster>-<namespace>` kubeconfig secret contract.
+
 ## v1.0.5 - 2026-08-29
 
 - Mount a temporary private copy of Google Workload Identity credentials so the

README.md

@@ -381,6 +381,18 @@ For monorepo or multi-repo setups where multiple repositories share infrastructu
 
 This isolates Terraform state per repository while allowing shared GCP project access.
 
+### Kubernetes Modules
+
+The `k8s-*` modules read the cluster kubeconfig from a Secret Manager secret
+named `k8s-config-<cluster>-<namespace>` in `shared_project` (defaults to
+`project_id`). Before deploying Kubernetes resources:
+
+1. Create the secret `k8s-config-<k8s_cluster_name>-<namespace>` containing a
+   kubeconfig for the target cluster and namespace.
+2. Grant the deploy service account `roles/secretmanager.secretAccessor` on it.
+3. Set `shared_project` only if that secret lives in a different GCP project
+   than `project_id`.
+
 ### Pinning R2A Version
 
 Always pin to a specific version for reproducible builds:
@@ -446,7 +458,7 @@ The optional state-backend inputs are passed through to the IaC engine. Omit the
 | `environment` | — | auto | Override environment |
 | `print_config` | — | `true` | Debug config output |
 | `multi_repo` | — | `false` | Per-repo state isolation |
-| `shared_project` | — | — | Shared GCP project |
+| `shared_project` | — | `project_id` | GCP project holding the `k8s-config-<cluster>-<namespace>` kubeconfig secret |
 | `k8s_cluster_name` | — | — | GKE cluster name |
 | `newrelic_account_id` | — | — | New Relic account ID |
 | `newrelic_api_key` | — | — | New Relic API key |

action.yml

@@ -46,7 +46,7 @@ inputs:
     required: false
     default: "false"
   shared_project:
-    description: "Shared GCP project for cross-project K8s cluster access"
+    description: "GCP project that holds the k8s-config-<cluster>-<namespace> kubeconfig secret for Kubernetes modules (default: project_id)"
     required: false
 
   # Kubernetes
@@ -523,7 +523,7 @@ runs:
         NEWRELIC_API_KEY: ${{ inputs.newrelic_api_key }}
         DOCKERHUB_USERNAME: ${{ inputs.dockerhub_username }}
         DOCKERHUB_TOKEN: ${{ inputs.dockerhub_helm_token || inputs.dockerhub_token }}
-        SHARED_PROJECT: ${{ inputs.shared_project }}
+        SHARED_PROJECT: ${{ inputs.shared_project || inputs.project_id }}
         STATE_BACKEND: ${{ inputs.state_backend }}
         STATE_BACKEND_CONFIG: ${{ inputs.state_backend_config }}
         STATE_PREFIX_KEY: ${{ inputs.state_prefix_key }}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udx/github-rabbit-action",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "private": true,
   "description": "Rabbit Automation Action release manifest",
   "license": "GPL-2.0-only",