You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
╷
│ Error: Invalid template interpolation value
│
│ on .terraform/modules/myapp_workload_identity/modules/workload-identity/main.tf line 22, in locals:
│ 22: gcp_sa_fqn = "serviceAccount:${local.gcp_sa_email}"
│ ├────────────────
│ │ local.gcp_sa_email is null
│
│ The expression result is null. Cannot include a null value in a string template.
╵
╷
│ Error: Invalid template interpolation value
│
│ on .terraform/modules/myapp_workload_identity/modules/workload-identity/main.tf line 71, in module "annotate-sa":
│ 71: kubectl_create_command = "kubectl annotate --overwrite sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account=${local.gcp_sa_email}"
│ ├────────────────
│ │ local.gcp_sa_email is null
│
│ The expression result is null. Cannot include a null value in a string template.
╵
╷
│ Error: Missing required argument
│
│ with module.myapp_workload_identity.google_service_account_iam_member.main,
│ on .terraform/modules/myapp_workload_identity/modules/workload-identity/main.tf line 76, in resource "google_service_account_iam_member" "main":
│ 76: service_account_id = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0].name : google_service_account.cluster_service_account[0].name
│
│ The argument "service_account_id" is required, but no definition was found.
╵
Looks like the WI module is trying to fetch information about the service account before it exists... The example introduced by #974 uses depends_on to force Terraform to wait:
# example with existing GSAresource"google_service_account""custom" {
account_id="custom-gsa"project=var.project_id
}
module"workload_identity_existing_gsa" {
source="../../modules/workload-identity"project_id=var.project_idname=google_service_account.custom.account_iduse_existing_gcp_sa=true# wait till custom GSA is created to force module data source read during applydepends_on=[google_service_account.custom]
}
Should the README documentation be updated to match? Or is there a better way to define these dependencies for Terraform?
The text was updated successfully, but these errors were encountered:
Yes, please update the README. Unfortunately I don't think there's a way to fix this besides that workaround (since it's ultimately a bug in Terraform).
…#1062)
Addresses #1059 -- without the `depends_on` block, the WI module will
try to read a data source for a Google service account that has not yet
been created. This is alluded to in the Workload Identity examples but
not in the Workload Identity README. This commit updates the README to
include the `depends_on` block.
Co-authored-by: Morgante Pell <morgantep@google.com>
…terraform-google-modules#1062)
Addresses terraform-google-modules#1059 -- without the `depends_on` block, the WI module will
try to read a data source for a Google service account that has not yet
been created. This is alluded to in the Workload Identity examples but
not in the Workload Identity README. This commit updates the README to
include the `depends_on` block.
Co-authored-by: Morgante Pell <morgantep@google.com>
The following snippet from the README for existing GCP SA in the Workload Identity module:
fails for me with the error:
Looks like the WI module is trying to fetch information about the service account before it exists... The example introduced by #974 uses
depends_on
to force Terraform to wait:Should the README documentation be updated to match? Or is there a better way to define these dependencies for Terraform?
The text was updated successfully, but these errors were encountered: