workload identity

main.tf

locals {
  members = tolist([
    for i, v in setproduct(var.wli_namespaces, var.wli_services) :
    "serviceAccount:your-project-id.svc.id.goog[${v[0]}/${v[1]}]"
  ])
}

output.txt

members = [
  "serviceAccount:your-project-id.svc.id.goog[namespace-one/k8s-service-one]",
  "serviceAccount:your-project-id.svc.id.goog[namespace-one/k8s-service-two]",
  "serviceAccount:your-project-id.svc.id.goog[namespace-two/k8s-service-one]",
  "serviceAccount:your-project-id.svc.id.goog[namespace-two/k8s-service-two]",
  "serviceAccount:your-project-id.svc.id.goog[namespace-three/k8s-service-one]",
  "serviceAccount:your-project-id.svc.id.goog[namespace-three/k8s-service-two]",
]

terraform.tfvars

wli_namespaces = ["namespace-one", "namespace-two", "namespace-three"]
wli_services   = ["k8s-service-one", "k8s-service-one"]

variables.tf

variable "wli_namespaces" {
  type    = list(string)
}

variable "wli_services" {
  type    = list(string)
}