update README GKE Workload Identity instructions to be more accurate …

…and include the last step of annotating the k8s sa

Signed-off-by: Rover van der Noort <[email protected]>

README.md

@@ -199,8 +199,16 @@ Namespace is already created in step 1 above.
     ```bash
     gcloud iam service-accounts add-iam-policy-binding \
         --role roles/iam.workloadIdentityUser \
-        --member "serviceAccount:[$PROJECT_ID].svc.id.goog[$NAMESPACE/$KSA_NAME]" \
-        [$GSA_NAME]@[$PROJECT_ID].iam.gserviceaccount.com
+        --member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/$KSA_NAME]" \
+        $GSA_NAME@$PROJECT_ID.iam.gserviceaccount.com
+    ```
+
+4. Add annotation to Kubernetes Service Account
+
+    ```bash
+    kubectl annotate serviceaccount $KSA_NAME \
+        --namespace $NAMESPACE \
+        iam.gke.io/gcp-service-account=$GSA_NAME@$PROJECT_ID.iam.gserviceaccount.com
     ```
 
 In this case:

changelogs/unreleased/195-rvandernoort

@@ -0,0 +1 @@
+update README GKE Workload Identity instructions