Skip to content

fix: move deprecated to versioned resources #2521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HarisDotParis wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix: move deprecated to versioned resources #2521

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3bf68c8
fix: move depr kubernetes_config_map to versioned resource
HarisDotParis Jan 13, 2026
a787e25
fix: move depr kubernetes_service_account to versioned resource
HarisDotParis Jan 13, 2026
92cc557
fix: make example for workload_identity valid & syntax-correct
HarisDotParis Jan 13, 2026
bc63355
fix: change depr kubernetes_pod to versioned resource
HarisDotParis Jan 13, 2026
93f1407
terraform fmt
HarisDotParis Jan 26, 2026
0151eef
docker_generate_docs
HarisDotParis Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion autogen/main/masq.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion autogen/main/moved.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
6 changes: 3 additions & 3 deletions examples/deploy_service/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ module "gke" {
deletion_protection = false
}

resource "kubernetes_pod" "nginx-example" {
resource "kubernetes_pod_v1" "nginx-example" {
metadata {
name = "nginx-example"

Expand All @@ -63,14 +63,14 @@ resource "kubernetes_pod" "nginx-example" {
depends_on = [module.gke]
}

resource "kubernetes_service" "nginx-example" {
resource "kubernetes_service_v1" "nginx-example" {
metadata {
name = "terraform-example"
}

spec {
selector = {
app = kubernetes_pod.nginx-example.metadata[0].labels.app
app = kubernetes_pod_v1.nginx-example.metadata[0].labels.app
}

session_affinity = "ClientIP"
Expand Down
31 changes: 16 additions & 15 deletions examples/workload_identity/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,14 +60,15 @@ module "workload_identity" {
source = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
version = "~> 43.0"

project_id = var.project_id
name = "iden-${module.gke.name}"
namespace = "default"
use_existing_k8s_sa = false
project_id = var.project_id
name = "iden-${module.gke.name}"
network = var.network
subnetwork = var.subnetwork
ip_range_pods = var.ip_range_pods
}

# example with existing KSA
resource "kubernetes_service_account" "test" {
resource "kubernetes_service_account_v1" "test" {
metadata {
name = "foo-ksa"
}
Expand All @@ -80,13 +81,11 @@ module "workload_identity_existing_ksa" {
source = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
version = "~> 43.0"

project_id = var.project_id
name = "existing-${module.gke.name}"
cluster_name = module.gke.name
location = module.gke.location
namespace = "default"
use_existing_k8s_sa = true
k8s_sa_name = kubernetes_service_account.test.metadata[0].name
project_id = var.project_id
name = "existing-${module.gke.name}"
network = var.network
subnetwork = var.subnetwork
ip_range_pods = var.ip_range_pods
Comment on lines +86 to +88
Copy link
Copy Markdown

@patjlm patjlm Mar 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think those are irrelevant here, but the deleted ones should remain.

}

# example with existing GSA
Expand All @@ -99,9 +98,11 @@ module "workload_identity_existing_gsa" {
source = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
version = "~> 43.0"

project_id = var.project_id
name = google_service_account.custom.account_id
use_existing_gcp_sa = true
project_id = var.project_id
name = google_service_account.custom.account_id
network = var.network
subnetwork = var.subnetwork
ip_range_pods = var.ip_range_pods
Comment on lines +103 to +105
Copy link
Copy Markdown

@patjlm patjlm Mar 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, irrelevant fields, but use_existing_gcp_sa should be kept

# wait till custom GSA is created to force module data source read during apply
# https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/1059
depends_on = [google_service_account.custom]
Expand Down
2 changes: 1 addition & 1 deletion masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/beta-autopilot-private-cluster/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,12 @@

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
7 changes: 6 additions & 1 deletion modules/beta-autopilot-public-cluster/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,12 @@

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/beta-private-cluster-update-variant/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/beta-private-cluster/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster-update-variant/masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/beta-public-cluster-update-variant/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/beta-public-cluster/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
2 changes: 1 addition & 1 deletion modules/gke-autopilot-cluster/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -575,9 +575,9 @@ spec:
roles:
- level: Project
roles:
- roles/iam.serviceAccountUser
- roles/compute.admin
- roles/container.admin
- roles/iam.serviceAccountUser
services:
- compute.googleapis.com
- container.googleapis.com
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster-update-variant/masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/private-cluster-update-variant/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/masq.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
/******************************************
Create ip-masq-agent confimap
*****************************************/
resource "kubernetes_config_map" "ip_masq_agent" {
resource "kubernetes_config_map_v1" "ip_masq_agent" {
count = var.configure_ip_masq ? 1 : 0

metadata {
Expand Down
7 changes: 6 additions & 1 deletion modules/private-cluster/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
12 changes: 6 additions & 6 deletions modules/workload-identity/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ module "my-app-workload-identity" {
An existing Kubernetes service account can optionally be used.

```hcl
resource "kubernetes_service_account" "preexisting" {
resource "kubernetes_service_account_v1" "preexisting" {
metadata {
name = "preexisting-sa"
namespace = "prod"
Expand All @@ -85,8 +85,8 @@ module "my-app-workload-identity" {
use_existing_k8s_sa = true
cluster_name = "my-k8s-cluster-name"
location = "my-k8s-cluster-location"
name = kubernetes_service_account.preexisting.metadata[0].name
namespace = kubernetes_service_account.preexisting.metadata[0].namespace
name = kubernetes_service_account_v1.preexisting.metadata[0].name
namespace = kubernetes_service_account_v1.preexisting.metadata[0].namespace
project_id = var.project_id
}
```
Expand Down Expand Up @@ -134,9 +134,9 @@ This approach is required when managing multiple clusters. Omitting this step ca
```shell
Error: Get "http://localhost/api/v1/namespaces/default/serviceaccounts/your-service-account": dial tcp [::1]:80: connect: connection refused
│
│ with module.your_workload_identity.kubernetes_service_account.main[0],
│ on .terraform/modules/your_workload_identity/modules/workload-identity/main.tf line 50, in resource "kubernetes_service_account" "main":
│ 50: resource "kubernetes_service_account" "main" {
│ with module.your_workload_identity.kubernetes_service_account_v1.main[0],
│ on .terraform/modules/your_workload_identity/modules/workload-identity/main.tf line 50, in resource "kubernetes_service_account_v1" "main":
│ 50: resource "kubernetes_service_account_v1" "main" {
```

<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
Expand Down
6 changes: 3 additions & 3 deletions modules/workload-identity/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ locals {

# This will cause Terraform to block returning outputs until the service account is created
k8s_given_name = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
output_k8s_name = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account.main[0].metadata[0].name
output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account.main[0].metadata[0].namespace
output_k8s_name = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account_v1.main[0].metadata[0].name
output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account_v1.main[0].metadata[0].namespace

k8s_sa_project_id = var.k8s_sa_project_id != null ? var.k8s_sa_project_id : var.project_id
k8s_sa_gcp_derived_name = "serviceAccount:${local.k8s_sa_project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]"
Expand All @@ -49,7 +49,7 @@ resource "google_service_account" "cluster_service_account" {
create_ignore_already_exists = var.gcp_sa_create_ignore_already_exists
}

resource "kubernetes_service_account" "main" {
resource "kubernetes_service_account_v1" "main" {
count = var.use_existing_k8s_sa ? 0 : 1

automount_service_account_token = var.automount_service_account_token
Expand Down
20 changes: 20 additions & 0 deletions modules/workload-identity/moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
/**
* Copyright 2026 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

moved {
from = kubernetes_service_account.main
to = kubernetes_service_account_v1.main
}
7 changes: 6 additions & 1 deletion moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,12 @@ moved {

moved {
from = kubernetes_config_map.ip-masq-agent
to = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
from = kubernetes_config_map.ip_masq_agent
to = kubernetes_config_map_v1.ip_masq_agent
}

moved {
Expand Down
Loading