feat: WorkloadIdenity allow to use k8s sa from the different project

[ykyr]

WorkloadIdenity can be used for cross-project linking.
It is useful in some use-cases:

• when you have deployed workload with pre-created k8s SA in the GKE cluster that lives in the proj B. But we want to use Google SA from proj A.

PR adds the possibility to specify a different k8s_sa_project_id.

Example of usage:

module "my_app_workload_identity" {
  source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
  use_existing_k8s_sa = true
  annotate_k8s_sa     = false
  k8s_sa_name         = "my-k8s-sa"
  namespace           = "prod"
  k8s_sa_project_id   = "proj-B"
  name                = "my-gcp-sa"
  project_id          = "proj-A"
}

Terraform plan:

Terraform will perform the following actions:

  # module.my_app_workload_identity.google_service_account.cluster_service_account[0] will be created
  + resource "google_service_account" "cluster_service_account" {
      + account_id   = "my-gcp-sa"
      + disabled     = false
      + display_name = "GCP SA bound to K8S SA proj-B[my-k8s-sa]"
      + email        = (known after apply)
      + id           = (known after apply)
      + name         = (known after apply)
      + project      = "proj-A"
      + unique_id    = (known after apply)
    }

  # module.my_app_workload_identity.google_service_account_iam_member.main will be created
  + resource "google_service_account_iam_member" "main" {
      + etag               = (known after apply)
      + id                 = (known after apply)
      + member             = "serviceAccount:proj-B.svc.id.goog[prod/my-k8s-sa]"
      + role               = "roles/iam.workloadIdentityUser"
      + service_account_id = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[bharathkkb]

Thanks for the PR @ykyr

[comment-bot-dev]

@ykyr
Thanks for the PR! 🚀
✅ Lint checks have passed.