fix(google_workload_identity): Remove data.google_service_account to allow bootstrapping (#330)

* fix(google_workload_identity): Remove data.google_service_account to allow bootsrappining

* chore(docs): google_workload_identity/README.md

Author: jbuck

google_gke_tenant/gke_service_account.tf

@@ -5,7 +5,7 @@ resource "google_service_account" "gke-account" {
 }
 
 module "workload-identity-for-tenant-sa" {
-  source = "github.com/mozilla/terraform-modules//google_workload_identity?ref=v2.6.1"
+  source = "../google_workload_identity"
 
   name                = "gha-${var.application}"
   namespace           = "${var.application}-${var.environment}"
@@ -16,7 +16,7 @@ module "workload-identity-for-tenant-sa" {
 }
 
 module "workload-identity-for-generic-tenant-sa" {
-  source = "github.com/mozilla/terraform-modules//google_workload_identity?ref=v2.6.1"
+  source = "../google_workload_identity"
 
   name                = var.application
   namespace           = "${var.application}-${var.environment}"
@@ -27,7 +27,7 @@ module "workload-identity-for-generic-tenant-sa" {
 }
 
 module "workload-identity-for-tenant-external-secrets-sa" {
-  source = "github.com/mozilla/terraform-modules//google_workload_identity?ref=v2.6.1"
+  source = "../google_workload_identity"
 
   name                = "external-secrets"
   namespace           = "${var.application}-${var.environment}"

google_workload_identity/README.md

@@ -24,7 +24,6 @@ accounts to go with it
 
 | Name | Description |
 |------|-------------|
-| <a name="output_gcp_service_account"></a> [gcp\_service\_account](#output\_gcp\_service\_account) | GCP service account. |
 | <a name="output_gcp_service_account_email"></a> [gcp\_service\_account\_email](#output\_gcp\_service\_account\_email) | Email address of GCP service account. |
 | <a name="output_gcp_service_account_fqn"></a> [gcp\_service\_account\_fqn](#output\_gcp\_service\_account\_fqn) | FQN of GCP service account. |
 | <a name="output_gcp_service_account_name"></a> [gcp\_service\_account\_name](#output\_gcp\_service\_account\_name) | Name of GCP service account. |

google_workload_identity/main.tf

@@ -6,8 +6,10 @@
 
 locals {
   gcp_given_name = var.gcp_sa_name != null ? var.gcp_sa_name : substr(var.name, 0, 30)
-  gcp_sa_email   = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0].email : google_service_account.cluster_service_account[0].email
-  gcp_sa_fqn     = "serviceAccount:${local.gcp_sa_email}"
+  gcp_sa_email   = var.use_existing_gcp_sa ? var.gcp_sa_name : google_service_account.cluster_service_account[0].email
+  gcp_sa_id      = var.use_existing_gcp_sa ? "projects/${local.gcp_sa_project}/serviceAccounts/${local.gcp_sa_email}" : google_service_account.cluster_service_account[0].id
+  gcp_sa_member  = "serviceAccount:${local.gcp_sa_email}"
+  gcp_sa_project = one(regex("@(.+?)\\.", local.gcp_sa_email)) // Pull the project ID out of the service account
 
   # This will cause Terraform to block returning outputs until the service account is created
   k8s_given_name       = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
@@ -17,13 +19,6 @@ locals {
   k8s_sa_gcp_derived_name = "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]"
 }
 
-data "google_service_account" "cluster_service_account" {
-  count = var.use_existing_gcp_sa ? 1 : 0
-
-  account_id = local.gcp_given_name
-  project    = var.project_id
-}
-
 resource "google_service_account" "cluster_service_account" {
   count = var.use_existing_gcp_sa ? 0 : 1
 
@@ -46,7 +41,7 @@ resource "kubernetes_service_account" "main" {
 }
 
 resource "google_service_account_iam_member" "main" {
-  service_account_id = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0].name : google_service_account.cluster_service_account[0].name
+  service_account_id = local.gcp_sa_id
   role               = "roles/iam.workloadIdentityUser"
   member             = local.k8s_sa_gcp_derived_name
 }
@@ -56,5 +51,5 @@ resource "google_project_iam_member" "workload_identity_sa_bindings" {
 
   project = var.project_id
   role    = each.value
-  member  = local.gcp_sa_fqn
-}
+  member  = local.gcp_sa_member
+}

google_workload_identity/outputs.tf

@@ -16,15 +16,10 @@ output "gcp_service_account_email" {
 
 output "gcp_service_account_fqn" {
   description = "FQN of GCP service account."
-  value       = local.gcp_sa_fqn
+  value       = local.gcp_sa_member
 }
 
 output "gcp_service_account_name" {
   description = "Name of GCP service account."
   value       = local.k8s_sa_gcp_derived_name
 }
-
-output "gcp_service_account" {
-  description = "GCP service account."
-  value       = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0] : google_service_account.cluster_service_account[0]
-}