feat: Workload Identity module, to bind roles in various projects for the service account created

modules/workload-identity/README.md

@@ -20,11 +20,13 @@ Note: This module currently supports Kubernetes <= 1.23.
 
 ```hcl
 module "my-app-workload-identity" {
-  source     = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  name       = "my-application-name"
-  namespace  = "default"
-  project_id = "my-gcp-project-name"
-  roles      = ["roles/storage.admin", "roles/compute.admin"]
+  source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
+  name                = "my-application-name"
+  namespace           = "default"
+  project_id          = "my-gcp-project-name"
+  roles               = ["roles/storage.admin", "roles/compute.admin"]
+  additional_projects = {"my-gcp-project-name1" : ["roles/storage.admin", "roles/compute.admin"],
+                         "my-gcp-project-name2" : ["roles/storage.admin", "roles/compute.admin"]}
 }
 ```
 
@@ -99,6 +101,7 @@ already bear the `"iam.gke.io/gcp-service-account"` annotation.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| additional\_projects | A list of roles to be added to the created service account for additional projects | `map(list(string))` | `{}` | no |
 | annotate\_k8s\_sa | Annotate the kubernetes service account with 'iam.gke.io/gcp-service-account' annotation. Valid in cases when an existing SA is used. | `bool` | `true` | no |
 | automount\_service\_account\_token | Enable automatic mounting of the service account token | `bool` | `false` | no |
 | cluster\_name | Cluster name. Required if using existing KSA. | `string` | `""` | no |

modules/workload-identity/main.tf

@@ -89,3 +89,11 @@ resource "google_project_iam_member" "workload_identity_sa_bindings" {
   role    = each.value
   member  = local.gcp_sa_fqn
 }
+
+resource "google_project_iam_member" "workload_identity_sa_bindings_additional_projects" {
+  for_each = toset(distinct(flatten([for project, roles in var.additional_projects : [for role in roles : join("=>", [project, role])]])))
+
+  project = element(split("=>", each.value), 0)
+  role    = element(split("=>", each.value), 1)
+  member  = local.gcp_sa_fqn
+}

modules/workload-identity/variables.tf

@@ -107,3 +107,9 @@ variable "module_depends_on" {
   type        = list(any)
   default     = []
 }
+
+variable "additional_projects" {
+  description = "A list of roles to be added to the created service account for additional projects"
+  type        = map(list(string))
+  default     = {}
+}