Error applying IAM policy for service account after running terraform apply for creating gks cluster

[pancudaniel7]

After running terraform apply using terraform file

module "jx" {
  source  = "jenkins-x/jx/google"

  gcp_project = "<my-gcp-project-id>"
}

At the end of process I get:

Error: Error applying IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-vo@x-project-275408.iam.gserviceaccount.com': Error setting IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-vo@x-project-275408.iam.gserviceaccount.com': googleapi: Error 400: Identity namespace does not exist (x-project-275408.svc.id.goog)., badRequest

on .terraform/modules/jx/terraform-google-jx-1.2.5/modules/backup/main.tf line 44, in resource "google_service_account_iam_member" "velero_sa_workload_identity_user":
44: resource "google_service_account_iam_member" "velero_sa_workload_identity_user" {

Error: Error applying IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-bc@x-project-275408.iam.gserviceaccount.com': Error setting IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-bc@x-project-275408.iam.gserviceaccount.com': googleapi: Error 400: Identity namespace does not exist (x-project-275408.svc.id.goog)., badRequest

on .terraform/modules/jx/terraform-google-jx-1.2.5/modules/cluster/serviceaccount.tf line 73, in resource "google_service_account_iam_member" "build_controller_sa_workload_identity_user":
73: resource "google_service_account_iam_member" "build_controller_sa_workload_identity_user" {

Error: Error applying IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-ko@x-project-275408.iam.gserviceaccount.com': Error setting IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-ko@x-project-275408.iam.gserviceaccount.com': googleapi: Error 400: Identity namespace does not exist (x-project-275408.svc.id.goog)., badRequest

on .terraform/modules/jx/terraform-google-jx-1.2.5/modules/cluster/serviceaccount.tf line 124, in resource "google_service_account_iam_member" "kaniko_sa_workload_identity_user":
124: resource "google_service_account_iam_member" "kaniko_sa_workload_identity_user" {

Error: Error applying IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-tekton@x-project-275408.iam.gserviceaccount.com': Error setting IAM policy for service account 'projects/x-project-275408/serviceAccounts/tf-jx-arriving-frog-tekton@x-project-275408.iam.gserviceaccount.com': googleapi: Error 400: Identity namespace does not exist (x-project-275408.svc.id.goog)., badRequest

on .terraform/modules/jx/terraform-google-jx-1.2.5/modules/cluster/serviceaccount.tf line 133, in resource "google_service_account_iam_member" "tekton_sa_workload_identity_user":
133: resource "google_service_account_iam_member" "tekton_sa_workload_identity_user" {

[hferentschik]

Have you tried re-running terraform apply? I have seen timing issues sometimes which results in similar errors. It worked the second time around.

[hferentschik]

🎉 This issue has been resolved in version 1.3.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[cprovencher]

@hferentschik getting same error in version 1.3.2

on .terraform/modules/jx/terraform-google-jx-1.3.2/modules/backup/main.tf line 44, in resource "google_service_account_iam_member" "velero_sa_workload_identity_user":
44: resource "google_service_account_iam_member" "velero_sa_workload_identity_user" {

[mayankkhullar]

Please enable IAM Policy API from GCP console , I did it and it worked