fix: add service account access for gke in shared vpc

[tenminus11]

According to https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-shared-vpc#enabling_and_granting_roles

roles/compute.networkUser access on SERVICE_PROJECT_NUM@cloudservices.gserviceaccount.com in subnetwork is missing in the terraform module

current terraform module fails to deploy a usable cluster, and system related pods doesn't come up
This fix give the required access which is needed

[bharathkkb]

Thanks for the PR @tenminus11

IIRC we actually grant these in the main module. Are you using a different module to create projects?

terraform-google-project-factory/modules/core_project_factory/main.tf

Lines 250 to 272 in 6b0412e

	resource "google_compute_subnetwork_iam_member" "apis_service_account_role_to_vpc_subnets" {
	provider = google-beta
	count = var.grant_network_role && var.enable_shared_vpc_service_project && length(var.shared_vpc_subnets) > 0 ? length(var.shared_vpc_subnets) : 0
	subnetwork = element(
	split("/", var.shared_vpc_subnets[count.index]),
	index(
	split("/", var.shared_vpc_subnets[count.index]),
	"subnetworks",
	) + 1,
	)
	role = "roles/compute.networkUser"
	region = element(
	split("/", var.shared_vpc_subnets[count.index]),
	index(split("/", var.shared_vpc_subnets[count.index]), "regions") + 1,
	)
	project = var.shared_vpc
	member = local.api_s_account_fmt
	depends_on = [
	module.project_services,
	]
	}

[bharathkkb]

/gcbrun

[bharathkkb]

/gcbrun

[bharathkkb]

Discussed offline, usecase was for just svpc setup without project creation. This should be no-op if used together with main module.