identity_namespace output is "enabled" instead of [project_id].svc.id.goog for beta-private-cluster

[schostin]

We are using module version 8.1.0 and when I create a beta-private-cluster with the default identity_namespace = "enabled" the output value of identity_namespace is also "enabled". I would expect [project_id].svc.id.goog as output here. Any opinions on this? Happy to issue a PR if needed :)

[morgante]

Yeah looks like a bug in the output. Just need to update it to point to the actual value from the cluster.

[schostin]

I was just able to get all tests working on my machine and would love to fix this. So therefore a question popped up:

• What is the rational of having the workload identity configuration block as dynamic. Currently there is only one workload identity namespace supported and therefore the module could just reflect this. If the workload identity namespace is a dynamic based on a list, the output of identity_namespace should therefore be a list as well?

Any opinions on this? Imho there are 2 possibilities:

1. Having workload_identity_config as a dynamic as it is now. Change the inputs / outputs to be a list as well to match this.
2. Having workload_identity_config be a single "resource" and remove the dynamic part, only a small change on the output side would be needed then.

I would favor version 2 here since it is not clear, when and if multiple workload identity namespace will come.

[morgante]

It's dynamic because workload identity can be disabled. In such cases we omit the block entirely. The block should be kept as-is (dynamic).

We shouldn't change the output much either. There's no need to make it a list.

This should work fine:

output "identity_namespace" {
  description = "Workload Identity namespace"
  value       = length(local.cluster_workload_identity_config) > 0 ? local.local.cluster_workload_identity_config[0].identity_namespace : null
  depends_on = [
    google_container_cluster.primary
  ]
}

[schostin]

Fine with me. Will adjust the output tomorrow and try to add a test for it. Will issue the PR once it's ready and I've played around with tests a bit.