fix: issue with kubernetes_service_account in k8s 1.24

[y4ssi]

The problem when generating new service accounts, is that the secret containing the SA token is no longer generated automatically since the LegacyServiceAccountTokenNoAutoGeneration feature gate was enabled as true in Kubernetes clusters version 1.24.
(references: kubernetes/enhancements#2799
https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/)

This is the reported issue for the terraform resource kubernetes_service_account
hashicorp/terraform-provider-kubernetes#1724

Alternative changes were made using the terraform resource kubernetes_manifest to manually generate the service accounts along with their secret

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[bharathkkb]

Thanks for the PR @yasserisa

[bharathkkb]

Using the manifest resource has a limitation which requires the cluster to be available at plan time. We may have to look at other alternatives.

https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest#before-you-use-this-resource

[y4ssi]

That's a very good point.

I found a community module that might solve the problem.

https://registry.terraform.io/providers/gavinbunney/kubectl/latest

Another alternative I was thinking about is that we occupy a script using this module

https://github.com/terraform-google-modules/terraform-google-gcloud/tree/master/modules/kubectl-wrapper

[comment-bot-dev]

@yasserisa
Thanks for the PR! 🚀
✅ Lint checks have passed.

[bharathkkb]

@yasserisa Looks like there is some movement in the provider to fix this. Since this will be a breaking change if we switch to wrapper I am leaning towards waiting a bit to see if the fix will help.

[y4ssi]

@yasserisa Looks like there is some movement in the provider to fix this. Since this will be a breaking change if we switch to wrapper I am leaning towards waiting a bit to see if the fix will help.

@bharathkkb

I have seen that the PR was generated yesterday to fix the problem.

hashicorp/terraform-provider-kubernetes#1792

I agree to wait, as I saw in the PR, the kubernetes_service_account resource will not wait for the creation of the secret, so I assume that all we would have to do is subsequent to the SA creation is to generate the secret manually, in that case we could use the kubernetes_secret resource and so we keep the code cleaner without adding a breaking change.

[bharathkkb]

hashicorp/terraform-provider-kubernetes#1792 was merged so I am closing this. We may need to constrain the provider to new min version once released.