<p>I have a private GKE cluster with no public endpoint. I have confirmed that I can authenticate and run <code>kubectl</code> commands against the cluster with my principal account. I am deploying Terraform from the same VM I tested the <code>kubectl</code> commands against and have added that IP address to the cluster's Master Authorized Networks.</p>
<p>Whenever I try to deploy workload identity with Terraform, I receive this error:</p>
<pre><code>Error: Post &quot;https://10.0.0.2/api/v1/namespaces/default/serviceaccounts&quot;: context deadline exceeded

  on .terraform/modules/gke-workload-identity/modules/workload-identity/main.tf line 48, in resource &quot;kubernetes_service_account&quot; &quot;main&quot;:
  48: resource &quot;kubernetes_service_account&quot; &quot;main&quot; {
</code></pre>
<p>I have granted the Service Account for Terraform deployment the proper IAM Roles for WI. I am using the standard <code>terraform-google-modules</code> for <a href="https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest/submodules/workload-identity" rel="nofollow noreferrer">workload identity</a> and GKE <a href="https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest/submodules/safer-cluster" rel="nofollow noreferrer">cluster</a>.</p>
<p>Here is also my TF Kubernetes provider block:</p>
<pre><code>provider &quot;kubernetes&quot; {
  host                   = &quot;https://${module.gke.endpoint}&quot;
  token                  = data.google_client_config.default.access_token
  cluster_ca_certificate = base64decode(module.gke.ca_certificate)
}
</code></pre>

Nick
<p><strong>Kubectl config view</strong></p>
<p>Displays merged kubeconfig settings or a specified kubeconfig file.</p>
<p><strong>Synopsis</strong></p>
<p>Displays merged kubeconfig settings or a specified kubeconfig file.</p>
<p>You can use –output jsonpath={…} to extract specific values using a jsonpath expression.</p>
<p><strong>Examples :</strong></p>
<pre><code>kubectl config view --raw
</code></pre>
<p>For Community reference <a href="https://jamesdefabia.github.io/docs/user-guide/kubectl/kubectl_config_view/" rel="nofollow noreferrer">kubectl_config_view</a></p>
