feat: workload-identity: Allow passing Google Service Account display_name and description

[kosta]

Straightforward change to allow passing display_name and description to the Service Account created by workload identity (as input variables gcp_sa_display_name and gcp_sa_description).

If these are not given (they default to null), the behaviour is the same as before.

Use case: we want to implement some conventions around service account display_name and description for all service accounts to follow (e.g. document how they were created). Without this change, this is only possible by moving the google service account terraform resource outside of the workload-identity module, which is cumbersome state juggling for existing service accounts.

I am not exactly sure what kind of tests are needed here, please advise.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[apeabody]

/gcbrun

[kosta]

I had to fix a copy/paste mistake in the variable validation test. Could you /gcbrun again? :)

[apeabody]

/gcbrun

[apeabody]

Hmm, the CI error doesn't immediately appear to be related to this change:

Step #72 - "verify sandbox-enabled-local":         	            	Diff:
Step #72 - "verify sandbox-enabled-local":         	            	--- Expected
Step #72 - "verify sandbox-enabled-local":         	            	+++ Actual
Step #72 - "verify sandbox-enabled-local":         	            	@@ -3,5 +3,3 @@
Step #72 - "verify sandbox-enabled-local":         	            	     "dnsCacheConfig": {},
Step #72 - "verify sandbox-enabled-local":         	            	-    "gcePersistentDiskCsiDriverConfig": {
Step #72 - "verify sandbox-enabled-local":         	            	-      "enabled": true
Step #72 - "verify sandbox-enabled-local":         	            	-    },
Step #72 - "verify sandbox-enabled-local":         	            	+    "gcePersistentDiskCsiDriverConfig": {},
Step #72 - "verify sandbox-enabled-local":         	            	     "gcpFilestoreCsiDriverConfig": {},
Step #72 - "verify sandbox-enabled-local":         	Test:       	TestSandboxEnabled

Might be related to hashicorp/terraform-provider-google#16794 as this was run using the TPG 5.11.0 driver.

[kosta]

Is there anything I can do about the test failure? All I could think of was rebasing on current main branch but there are no new commits to rebase to.

[apeabody]

Is there anything I can do about the test failure? All I could think of was rebasing on current main branch but there are no new commits to rebase to.

I just merged in a change to fix the CI, re-running the tests.

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[kosta]

I merged master once more, maybe another /gcbrun will be green?

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[apeabody]

CI is intermittently hitting a quota:

googleapi: Error 403: Quota exceeded for quota metric 'Read requests' and limit 'Read requests per minute per region' of service 'compute.googleapis.com' for consumer

[apeabody]

/gcbrun

[apeabody]

Thanks for the contribution @kosta!