[hamadfadi]

Introduce a reusable community Terraform module to manage and explicitly provision Google Cloud service agent identities via google_project_service_identity.

Submission Checklist

NOTE: Community submissions can take up to 2 weeks to be reviewed.

Please take the following actions before submitting this pull request.

• Fork your PR branch from the Toolkit "develop" branch (not main)
• Test all changes with pre-commit in a local branch #
• Confirm that "make tests" passes all tests
• Add or modify unit tests to cover code changes
• Ensure that unit test coverage remains above 80%
• Update all applicable documentation
• Follow Cluster Toolkit Contribution guidelines #

[hamadfadi]

Why this is needed:
- On newly initialized GCP projects, Google Cloud creates service agent
identities lazily (often only after the first resource or job is submitted).
- Downstream modules attempting to bind IAM roles to a service agent fail
during single-pass deployments with "service account does not exist".
- This module ensures the API service is enabled and explicitly provisions
the service identity upfront.
Features:
- Ensures target GCP API service is enabled (google_project_service) with disable_on_destroy = false.
- Explicitly generates the service identity (google_project_service_identity) for any specified service.
- Outputs service_agent_email for immediate use in downstream IAM policies.

[github-actions]

this PR has been inactive for 3 days and has no unresolved comments. @SwarnaBharathiMantena, @ishitachail, @vikramvs-gg, please review.

[github-actions]

this PR has been inactive for 3 days and has no unresolved comments. @SwarnaBharathiMantena, @ishitachail, @vikramvs-gg, please review.

[github-actions]

This is a second reminder that this PR has been inactive for 4 days and has no unresolved comments. @SwarnaBharathiMantena, @ishitachail, @vikramvs-gg, please review.

[SwarnaBharathiMantena]

Similar to the pre-existing-project module on PR #6295, let us move this module under project.

community/modules/internal/project/service-agent
  → community/modules/project/service-agent

Please update the README example source: path with the move, and match the
## Description opening the sibling modules use.

Please also update the modules/README.md.

[hamadfadi]

Similar to the pre-existing-project module on PR #6295, let us move this module under project.

community/modules/internal/project/service-agent
  → community/modules/project/service-agent

Please update the README example source: path with the move, and match the ## Description opening the sibling modules use.

Please also update the modules/README.md.

@SwarnaBharathiMantena thank you for the suggestion.
Moved to community/modules/project/service-agent, README updated to the ## Description style the sibling modules use, with the source path fixed. Added to modules/README.md.

[SwarnaBharathiMantena]

LGTM