fix(airbyte): fix workload identity (#796)

* fix(airbyte): fix workload identity

* chore: bump vsn

Author: walkoss

airbyte/helm/airbyte/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: airbyte
 description: Unified data integration platform
 type: application
-version: 0.4.23
+version: 0.4.24
 appVersion: 0.50.8
 dependencies:
 - name: airbyte

airbyte/helm/airbyte/values.yaml.tpl

@@ -118,3 +118,8 @@ airbyte:
       rootUser: {{ importValue "Terraform" "access_key_id" }}
       rootPassword: {{ importValue "Terraform" "secret_access_key" }}
   {{- end }}
+  serviceAccount:
+    {{ if $isGcp }}
+    annotations:
+      iam.gke.io/gcp-service-account: {{ importValue "Terraform" "gcp_sa_email" }}
+    {{ end }}

airbyte/terraform/gcp/deps.yaml

@@ -2,7 +2,7 @@ apiVersion: plural.sh/v1alpha1
 kind: Dependencies
 metadata:
   description: airbyte gcp setup 
-  version: 0.1.4
+  version: 0.1.5
 spec:
   dependencies:
   - name: gcp-bootstrap
@@ -15,3 +15,4 @@ spec:
     access_key_id: access_key_id
     secret_access_key: secret_access_key
     credentials_json: credentials_json
+    gcp_sa_email: gcp_sa_email

airbyte/terraform/gcp/main.tf

@@ -64,29 +64,18 @@ resource "kubernetes_secret" "google-application-credentials" {
 
 module "airbyte-workload-identity" {
   source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
-  name                = "${var.cluster_name}-airbyte-wi"
+  name                = "${var.cluster_name}-airbyte"
   namespace           = var.namespace
   project_id          = var.project_id
   use_existing_k8s_sa = true
   annotate_k8s_sa     = false
-  k8s_sa_name         = "default"
+  k8s_sa_name         = "airbyte-admin"
   roles               = var.roles
+  gcp_sa_name         = google_service_account.airbyte.name
+  use_existing_gcp_sa = true
 
   depends_on = [
-    kubernetes_namespace.airbyte
-  ]
-}
-
-resource "kubernetes_default_service_account" "default" {
-  metadata {
-    name      = "default"
-    namespace = var.namespace
-    annotations = {
-      "iam.gke.io/gcp-service-account" = module.airbyte-workload-identity.gcp_service_account_email
-    }
-  }
-
-  depends_on = [
-    kubernetes_namespace.airbyte
+    kubernetes_namespace.airbyte,
+    google_service_account.airbyte
   ]
 }

airbyte/terraform/gcp/outputs.tf

@@ -9,3 +9,7 @@ output "secret_access_key" {
 output "credentials_json" {
   value = google_service_account_key.airbyte_key.private_key
 }
+
+output "gcp_sa_email" {
+  value = google_service_account.airbyte.email
+}