<p>I'm using Terraform workload-identity module , to create Kubernetes service account in Google Cloud. When i apply the changes, I'm getting below warning.</p>
<blockquote>
<p>&quot;default_secret_name&quot; is no longer applicable for Kubernetes v1.24.0
and above │ │   with
module.app-workload-identity.kubernetes_service_account_v1.main, │<br />
on ../../modules/workload-identity/main.tf line 57, in resource
&quot;kubernetes_service_account_v1&quot; &quot;main&quot;: │   57: resource
&quot;kubernetes_service_account_v1&quot; &quot;main&quot; { │ │ Starting from version
1.24.0 Kubernetes does not automatically generate a token for service accounts, in this case, &quot;default_secret_name&quot; will be  │ empty</p>
</blockquote>
<p><strong>Workload-Identity main.tf</strong></p>
<pre><code>locals {
  service_account_tmp = var.google_service_account_email== &quot;&quot; ? &quot;projects/${var.project_id}/serviceAccounts/cloudsql-sa@${var.project_id}.iam.gserviceaccount.com&quot; : var.google_service_account_email
  service_id = &quot;projects/${var.project_id}/serviceAccounts/cloudsql-sa@${var.project_id}.iam.gserviceaccount.com&quot;
  k8s_sa_gcp_derived_name = &quot;serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]&quot;
  gcp_sa_email            = var.google_service_account_email

  # This will cause terraform to block returning outputs until the service account is created
  k8s_given_name       = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
  output_k8s_name      = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account.main[0].metadata[0].name
  output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account.main[0].metadata[0].namespace
}

# resource &quot;google_service_account&quot; &quot;cluster_service_account&quot; {
  # GCP service account ids must be &lt; 30 chars matching regex ^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$
  # KSA do not have this naming restriction.
  # account_id   = substr(var.name, 0, 30)
  # display_name = substr(&quot;GCP SA bound to K8S SA ${local.k8s_given_name}&quot;, 0, 100)
  # project      = var.project_id
# }
resource &quot;kubernetes_namespace&quot; &quot;k8s_namespace&quot; {
  metadata {
    name = var.namespace
  }
}

# resource &quot;kubernetes_secret_v1&quot; &quot;main&quot; {
#  metadata {
#    name      = var.name
#    namespace = var.namespace
#    annotations = {
#      &quot;kubernetes.io/service-account.name&quot;      = kubernetes_service_account_v1.main.metadata.0.name
#      &quot;kubernetes.io/service-account.namespace&quot; = kubernetes_service_account_v1.main.metadata.0.namespace
#    }
#    generate_name = &quot;${kubernetes_service_account_v1.main.metadata.0.name}-token-&quot;
#  }
#  type = &quot;kubernetes.io/service-account-token&quot;
#  wait_for_service_account_token = true
#}

resource &quot;kubernetes_service_account&quot; &quot;main&quot; {
  count = var.use_existing_k8s_sa ? 0 : 1
  metadata {
    name      = var.name
    namespace = var.namespace
    annotations = {
      &quot;iam.gke.io/gcp-service-account&quot; = var.google_service_account_email
    }
  }
}


module &quot;annotate-sa&quot; {
  source  = &quot;terraform-google-modules/gcloud/google//modules/kubectl-wrapper&quot;
  version = &quot;~&gt; 2.0.2&quot;

  enabled          = var.use_existing_k8s_sa &amp;&amp; var.annotate_k8s_sa
  skip_download    = true
  cluster_name     = var.cluster_name
  cluster_location = var.location
  project_id       = var.project_id

  kubectl_create_command  = &quot;kubectl annotate --overwrite sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account=${local.gcp_sa_email}&quot;
  kubectl_destroy_command = &quot;kubectl annotate sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account-&quot;
}

resource &quot;google_service_account_iam_member&quot; &quot;main&quot; {
  service_account_id = local.service_id
  role               = &quot;roles/iam.workloadIdentityUser&quot;
  member             = local.k8s_sa_gcp_derived_name
}
</code></pre>
<p>As per the <a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account" rel="nofollow noreferrer">this</a> documentation , I have tried to add the resource &quot;kubernetes_secret_v1&quot; to create a service account token. But still getting the same warning message.</p>

user2439278
<p>From this <a href="https://github.com/hashicorp/terraform-provider-kubernetes/pull/1792" rel="nofollow noreferrer">git issue</a> kubernetes_service_account issue has been successfully fixed using this <a href="https://github.com/hashicorp/terraform-provider-kubernetes/pull/1792/files/04140ea649a2dcdaffb2da3f85dde35320fd97c8#diff-c743e045ffac6c322ed857bb5f5b6efa1b2d854c02de71996f9d937e0242dd03" rel="nofollow noreferrer">manifest</a>.</p>
<p>I found this <a href="https://github.com/yasserisa/terraform-google-kubernetes-engine/commit/a1972155e856c702c13f1196a202f65b71378bde" rel="nofollow noreferrer">alternative solution</a> where changes are made using the terraform resource kubernetes_manifest to manually generate the service accounts along with their secret.</p>
<p>Can you try the main.tf file and let me know if this works.</p>
<p>For more information follow this <a href="https://github.com/hashicorp/terraform-provider-kubernetes/issues/1724" rel="nofollow noreferrer">Issue</a>.</p>
