fix: issue with kubernetes_service_account in k8s 1.24

modules/workload-identity/README.md

@@ -99,12 +99,12 @@ already bear the `"iam.gke.io/gcp-service-account"` annotation.
 |------|-------------|------|---------|:--------:|
 | annotate\_k8s\_sa | Annotate the kubernetes service account with 'iam.gke.io/gcp-service-account' annotation. Valid in cases when an existing SA is used. | `bool` | `true` | no |
 | automount\_service\_account\_token | Enable automatic mounting of the service account token | `bool` | `false` | no |
-| cluster\_name | Cluster name. Required if using existing KSA. | `string` | `""` | no |
+| cluster\_name | Cluster name. | `string` | `""` | no |
 | gcp\_sa\_name | Name for the Google service account; overrides `var.name`. | `string` | `null` | no |
 | impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
 | k8s\_sa\_name | Name for the Kubernetes service account; overrides `var.name`. `cluster_name` and `location` must be set when this input is specified. | `string` | `null` | no |
 | k8s\_sa\_project\_id | GCP project ID of the k8s service account; overrides `var.project_id`. | `string` | `null` | no |
-| location | Cluster location (region if regional cluster, zone if zonal cluster). Required if using existing KSA. | `string` | `""` | no |
+| location | Cluster location (region if regional cluster, zone if zonal cluster). | `string` | `""` | no |
 | name | Name for both service accounts. The GCP SA will be truncated to the first 30 chars if necessary. | `string` | n/a | yes |
 | namespace | Namespace for the Kubernetes service account | `string` | `"default"` | no |
 | project\_id | GCP project ID | `string` | n/a | yes |

modules/workload-identity/main.tf

@@ -22,10 +22,9 @@ locals {
   gcp_sa_fqn     = "serviceAccount:${local.gcp_sa_email}"
 
   # This will cause Terraform to block returning outputs until the service account is created
-  k8s_given_name       = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
-  output_k8s_name      = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account.main[0].metadata[0].name
-  output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account.main[0].metadata[0].namespace
-
+  k8s_given_name          = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
+  output_k8s_name         = var.use_existing_k8s_sa ? local.k8s_given_name : data.kubernetes_secret.main.metadata.0.name
+  output_k8s_namespace    = var.use_existing_k8s_sa ? var.namespace : data.kubernetes_secret.main.metadata.0.namespace
   k8s_sa_project_id       = var.k8s_sa_project_id != null ? var.k8s_sa_project_id : var.project_id
   k8s_sa_gcp_derived_name = "serviceAccount:${local.k8s_sa_project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]"
 }
@@ -45,17 +44,76 @@ resource "google_service_account" "cluster_service_account" {
   project      = var.project_id
 }
 
-resource "kubernetes_service_account" "main" {
+module "service_account" {
   count = var.use_existing_k8s_sa ? 0 : 1
 
-  automount_service_account_token = var.automount_service_account_token
+  source                      = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
+  version                     = "~> 3.1"
+  enabled                     = var.use_existing_k8s_sa ? false : true
+  skip_download               = true
+  cluster_name                = var.cluster_name
+  cluster_location            = var.location
+  project_id                  = local.k8s_sa_project_id
+  impersonate_service_account = var.impersonate_service_account
+  use_existing_context        = var.use_existing_context
+  internal_ip                 = false
+  kubectl_create_command      = <<-EOT
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ${local.k8s_given_name}
+  namespace: ${var.namespace}
+  annotations:
+    iam.gke.io/gcp-service-account: ${local.gcp_sa_email}
+secrets:
+- name: ${local.k8s_given_name}
+EOF
+
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${local.k8s_given_name}
+  namespace: ${var.namespace}
+  annotations:
+    kubernetes.io/service-account.name: ${local.k8s_given_name}
+type: kubernetes.io/service-account-token
+EOF
+EOT
+
+  kubectl_destroy_command = <<-EOT
+kubectl delete -f - <<EOF || echo "resource does not exist"
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: local.k8s_given_name
+  namespace: ${var.namespace}
+  annotations:
+    iam.gke.io/gcp-service-account: ${local.gcp_sa_email}
+secrets:
+- name: ${local.k8s_given_name}
+EOF
+
+kubectl delete -f - <<EOF || echo "resource does not exist"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${local.k8s_given_name}
+  namespace: ${var.namespace}
+  annotations:
+    kubernetes.io/service-account.name: ${local.k8s_given_name}
+type: kubernetes.io/service-account-token
+EOF
+EOT
+}
+
+data "kubernetes_secret" "main" {
   metadata {
     name      = local.k8s_given_name
     namespace = var.namespace
-    annotations = {
-      "iam.gke.io/gcp-service-account" = local.gcp_sa_email
-    }
   }
+  depends_on = [module.service_account]
 }
 
 module "annotate-sa" {

modules/workload-identity/variables.tf

@@ -37,13 +37,13 @@ variable "use_existing_gcp_sa" {
 }
 
 variable "cluster_name" {
-  description = "Cluster name. Required if using existing KSA."
+  description = "Cluster name."
   type        = string
   default     = ""
 }
 
 variable "location" {
-  description = "Cluster location (region if regional cluster, zone if zonal cluster). Required if using existing KSA."
+  description = "Cluster location (region if regional cluster, zone if zonal cluster)."
   type        = string
   default     = ""
 }