Pulumi example for GKE Workload Identity

index.ts

/*
Creates a GCP service account named 'test-workload-identity' to be used
by a GKE workload using a Kubernetes service account named 'default/default'.
*/

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const gcpConfig = new pulumi.Config("gcp");
const projectId = gcpConfig.get("project");

const ksa = "default/default";
const gsaName = "test-workload-identity";

const gsa = new gcp.serviceAccount.Account(gsaName, {
    accountId: gsaName,
    displayName: "An account for testing the GKE workload identity feature",
});

const binding = new gcp.serviceAccount.IAMBinding(`${gsaName}:${ksa}`, {
    serviceAccountId: pulumi.interpolate `projects/${projectId}/serviceAccounts/${gsa.email}`,
    members: [`serviceAccount:${projectId}.svc.id.goog[${ksa}]`],
    role: "roles/iam.workloadIdentityUser"
});

you got a typo in serviceAccount, it must be:

new gcp.serviceaccount.IAMBinding

notice account must be lowercase. Anyway, thank you so mush, this is exactly what I was looking for.