You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Thanks for the creating the workload-identity module and it saves me tons of time.
Now I have already set up the KSA's workload identity annotation via another source, which is helm.
So I am using the module to create the GCP Service Account resource to do the mapping, therefore I go ahead with use_existing_k8s_sa = true.
However, the annotate-sa will be keep re-created when I apply the terraform config, i.e.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement
Terraform will perform the following actions:
# module.vault_workload_identity.module.annotate-sa.null_resource.run_command[0] must be replaced
-/+ resource "null_resource" "run_command" {
~ id = "7716742383294981629" -> (known after apply)
~ triggers = { # forces replacement
~ "arguments" = "98c9e20dc25f83faf81364fb6a8e56b8" -> "a9c984dc6181e56976c2824ad45107d6"
~ "create_cmd_body" = "xxx"
"create_cmd_entrypoint" = ".terraform/modules/vault_workload_identity/terraform-google-kubernetes-engine-10.0.0/modules/workload-identity/scripts/kubectl_wrapper.sh"
~ "destroy_cmd_body" = "xxx"
"destroy_cmd_entrypoint" = ".terraform/modules/vault_workload_identity/terraform-google-kubernetes-engine-10.0.0/modules/workload-identity/scripts/kubectl_wrapper.sh"
"gcloud_bin_abs_path" = "xxx"
"md5" = "db357f7040b2589b799b5e90523802b5"
}
}
Plan: 1 to add, 0 to change, 1 to destroy.
------------------------------------------------------------------------
To solve this issue, it would be possible via adding an option to disable annotating the existing KSA. But open to learn about other solutions.
The text was updated successfully, but these errors were encountered:
Thanks for the creating the workload-identity module and it saves me tons of time.
Now I have already set up the KSA's workload identity annotation via another source, which is helm.
So I am using the module to create the GCP Service Account resource to do the mapping, therefore I go ahead with
use_existing_k8s_sa = true
.However, the annotate-sa will be keep re-created when I apply the terraform config, i.e.
To solve this issue, it would be possible via adding an option to disable annotating the existing KSA. But open to learn about other solutions.
The text was updated successfully, but these errors were encountered: