Skip to content

fix: Replace deprecated kubernetes_service_account with kubernetes_service_account_v1 #2560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nacholiya wants to merge 13 commits into
base: main
Choose a base branch
from
+16 −14
Open

fix: Replace deprecated kubernetes_service_account with kubernetes_service_account_v1 #2560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
09503aa
fix: replace deprecated kubernetes_service_account with kubernetes_se…
nacholiya Mar 23, 2026
c83a694
fix: update docs and examples for kubernetes_service_account_v1
nacholiya Mar 23, 2026
113e269
fix: remove unsupported secret block from kubernetes_service_account_…
nacholiya Mar 23, 2026
d2c5b25
fix: update references to kubernetes_service_account_v1
nacholiya Mar 24, 2026
31832e7
fix: correct namespace reference for kubernetes_service_account_v1
nacholiya Mar 26, 2026
db8e4e1
fix: update README to use kubernetes_service_account_v1 consistently
nacholiya Mar 30, 2026
51348cb
fix: remove version pinning for workload identity module in examples
nacholiya Mar 31, 2026
380e4d9
Merge branch 'main' into fix/kubernetes-sa-deprecation
nacholiya Apr 3, 2026
2735c79
Add moved block for kubernetes_service_account_v1 migration
nacholiya Apr 3, 2026
1021a8d
Apply suggestion from @gemini-code-assist[bot]
nacholiya Apr 10, 2026
0a77f97
fix: restore version lines as per maintainer feedback
nacholiya Apr 13, 2026
e7b7d1d
Merge branch 'main' into fix/kubernetes-sa-deprecation
apeabody May 12, 2026
99225f6
Merge branch 'main' into fix/kubernetes-sa-deprecation
apeabody May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions examples/workload_identity/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,13 +67,10 @@ module "workload_identity" {
}

# example with existing KSA
resource "kubernetes_service_account" "test" {
resource "kubernetes_service_account_v1" "test" {
metadata {
name = "foo-ksa"
}
secret {
name = "bar"
}
}

module "workload_identity_existing_ksa" {
Expand All @@ -86,7 +83,7 @@ module "workload_identity_existing_ksa" {
location = module.gke.location
namespace = "default"
use_existing_k8s_sa = true
k8s_sa_name = kubernetes_service_account.test.metadata[0].name
k8s_sa_name = kubernetes_service_account_v1.test.metadata[0].name
}

# example with existing GSA
Expand Down
12 changes: 6 additions & 6 deletions modules/workload-identity/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ module "my-app-workload-identity" {
An existing Kubernetes service account can optionally be used.

```hcl
resource "kubernetes_service_account" "preexisting" {
resource "kubernetes_service_account_v1" "preexisting" {
metadata {
name = "preexisting-sa"
namespace = "prod"
Expand All @@ -85,8 +85,8 @@ module "my-app-workload-identity" {
use_existing_k8s_sa = true
cluster_name = "my-k8s-cluster-name"
location = "my-k8s-cluster-location"
name = kubernetes_service_account.preexisting.metadata[0].name
namespace = kubernetes_service_account.preexisting.metadata[0].namespace
name = kubernetes_service_account_v1.preexisting.metadata[0].name
namespace = kubernetes_service_account_v1.preexisting.metadata[0].namespace
project_id = var.project_id
}
```
Expand Down Expand Up @@ -134,9 +134,9 @@ This approach is required when managing multiple clusters. Omitting this step ca
```shell
Error: Get "http://localhost/api/v1/namespaces/default/serviceaccounts/your-service-account": dial tcp [::1]:80: connect: connection refused
│
│ with module.your_workload_identity.kubernetes_service_account.main[0],
│ on .terraform/modules/your_workload_identity/modules/workload-identity/main.tf line 50, in resource "kubernetes_service_account" "main":
│ 50: resource "kubernetes_service_account" "main" {
│ with module.your_workload_identity.kubernetes_service_account_v1.main[0],
│ on .terraform/modules/your_workload_identity/modules/workload-identity/main.tf line 57, in resource "kubernetes_service_account_v1" "main":
│ 57: resource "kubernetes_service_account_v1" "main" {
```
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
Expand Down
11 changes: 8 additions & 3 deletions modules/workload-identity/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ locals {

# This will cause Terraform to block returning outputs until the service account is created
k8s_given_name = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
output_k8s_name = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account.main[0].metadata[0].name
output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account.main[0].metadata[0].namespace
Comment thread
apeabody marked this conversation as resolved.
output_k8s_name = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account_v1.main[0].metadata[0].name
output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account_v1.main[0].metadata[0].namespace

k8s_sa_project_id = var.k8s_sa_project_id != null ? var.k8s_sa_project_id : var.project_id
k8s_sa_gcp_derived_name = "serviceAccount:${local.k8s_sa_project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]"
Expand All @@ -49,7 +49,12 @@ resource "google_service_account" "cluster_service_account" {
create_ignore_already_exists = var.gcp_sa_create_ignore_already_exists
}

resource "kubernetes_service_account" "main" {
Comment thread
nacholiya marked this conversation as resolved.
moved {
from = kubernetes_service_account.main
to = kubernetes_service_account_v1.main
}

resource "kubernetes_service_account_v1" "main" {
Comment thread
apeabody marked this conversation as resolved.
count = var.use_existing_k8s_sa ? 0 : 1

automount_service_account_token = var.automount_service_account_token
Expand Down