fix(workload-identity): resolve inconsistent conditional result types in output

[raman1236]

Description

Fixes #1112

When use_existing_gcp_sa is unknown at plan time (e.g., comes from another resource's output), Terraform fails with:

Error: Inconsistent conditional result types

  on .../modules/workload-identity/output.tf line 44, in output "gcp_service_account":
    value = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0] : google_service_account.cluster_service_account[0]

The true and false result expressions must have consistent types.

Root Cause

The data.google_service_account data source and google_service_account resource return objects with slightly different attribute schemas. When Terraform can't determine which branch to evaluate at plan time, it requires both branches to have identical types.

Solution

Replace the conditional expression with one(concat(...)):

# Before
value = var.use_existing_gcp_sa ? data.google_service_account.cluster_service_account[0] : google_service_account.cluster_service_account[0]

# After
value = one(concat(
  data.google_service_account.cluster_service_account,
  google_service_account.cluster_service_account
))

This works because:

• Only one list will ever have elements (based on the mutually exclusive count conditions)
• concat() doesn't require type comparison between the list elements
• one() extracts the single element from the concatenated list

Backward Compatibility

The output value is identical - it still returns the full GCP service account object. Only the implementation changes to avoid the type mismatch error.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the gcp_service_account output in the workload-identity module to use one(concat(...)) instead of a conditional ternary operator. This change is intended to prevent potential type mismatch issues between the data source and the resource. I have no feedback to provide as there were no review comments.

[raman1236]

@apeabody @ayushmjain could one of you run /gcbrun to trigger the integration tests? The fix is ready for review.

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[raman1236]

@apeabody @ayushmjain could one of you review the PR the fix is ready for review.

[apeabody]

Thanks for the contribution @raman1236!

[apeabody]

/gcbrun