After the namespace migration, no export document is generated anymore (403)

Tasdir Export, a customs broker in Tangier, generates certificates of origin and pro forma invoices (PDF) for its exporter clients with the generateur-documents service, on the GKE cluster gke-tasdir-prod (europe-west9). The PDFs are written to the bucket gs://tasdir-documents-prod. The pod uses Workload Identity: the Kubernetes account sa-documents impersonates the Google account gsa-documents@tasdir-prod-6630.iam.gserviceaccount.com.

Yesterday, Mehdi (platform) did some cleanup: the historical namespace docs was replaced by documents (new quotas, NetworkPolicies). He recreated the sa-documents ServiceAccount with the same annotation and redeployed. The pods are Running.

This morning, no document is coming out: trucks are waiting for their certificates at the port of Tanger Med. The team suspects the permissions on the bucket.

You are on the bastion, with kubectl pointing at the cluster (namespace documents) and gcloud configured on tasdir-prod-6630.