README.md

Description

This module creates a Workload Identity binding between a Google Service Account (GSA) and a Kubernetes Service Account (KSA) in a GKE cluster.

Example usage

- id: workload_identity_binding
  source: modules/project/workload_identity_binding
  settings:
    project_id: $(vars.project_id)
    service_account_email: $(service_account.service_account_email)
    namespace: "my-namespace"
    k8s_service_account_name: "my-ksa"

License

Copyright 2026 Google LLC

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

 http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Requirements

Name	Version
terraform	>= 1.12.2
google	>= 3.83

Providers

Name	Version
google	>= 3.83

Modules

No modules.

Resources

Name	Type
google_service_account_iam_member.main	resource

Inputs

Name	Description	Type	Default	Required
k8s_service_account_name	The name of the Kubernetes Service Account (KSA) to bind.	string	n/a	yes
namespace	The Kubernetes namespace where the KSA is located.	string	"default"	no
project_id	The GCP project ID where the cluster is located.	string	n/a	yes
service_account_email	The email address of the Google Service Account (GSA) to bind (e.g., user@project.iam.gserviceaccount.com).	string	n/a	yes

Outputs

Name	Description
workload_identity_principal	The Workload Identity principal.