diff --git a/lib/core/terraform_config/dsl.rb b/lib/core/terraform_config/dsl.rb
index cb3b1b29..64ffdd62 100644
--- a/lib/core/terraform_config/dsl.rb
+++ b/lib/core/terraform_config/dsl.rb
@@ -30,6 +30,9 @@ def argument(name, value, optional: false, raw: false)
           "#{tf_value(value)}\n"
         end
 
+      # remove quotes from expression values
+      content = content.gsub(/("#{EXPRESSION_PATTERN}.*")/) { ::Regexp.last_match(1)[1...-1] }
+
       put("#{name} = #{content}", indent: 2)
     end
 
@@ -58,7 +61,6 @@ def tf_string_value(value)
     def tf_hash_value(value)
       JSON.pretty_generate(value.crush)
           .gsub(/"(\w+)":/) { "#{::Regexp.last_match(1)}:" } # remove quotes from keys
-          .gsub(/("#{EXPRESSION_PATTERN}.*")/) { ::Regexp.last_match(1)[1...-1] } # remove quotes from expression values
     end
 
     def expression?(value)
diff --git a/lib/core/terraform_config/generator.rb b/lib/core/terraform_config/generator.rb
index eb432b47..df6e856f 100644
--- a/lib/core/terraform_config/generator.rb
+++ b/lib/core/terraform_config/generator.rb
@@ -6,6 +6,7 @@ class Generator # rubocop:disable Metrics/ClassLength
     WORKLOAD_SPEC_KEYS = %i[
       type
       containers
+      identity_link
       default_options
       local_options
       rollout_options
@@ -120,7 +121,7 @@ def agent_config_params
     def workload_config_params
       template
         .slice(:name, :description, :tags)
-        .merge(gvc: gvc, identity: workload_identity)
+        .merge(gvc: gvc)
         .merge(workload_spec_params)
     end
 
@@ -176,13 +177,6 @@ def policy_bindings
       end
     end
 
-    def workload_identity
-      identity_link = template.dig(:spec, :identity_link)
-      return if identity_link.nil?
-
-      "cpln_identity.#{identity_link.split('/').last}"
-    end
-
     def kind
       @kind ||= template[:kind]
     end
diff --git a/lib/core/terraform_config/workload.rb b/lib/core/terraform_config/workload.rb
index d019e729..8b997c19 100644
--- a/lib/core/terraform_config/workload.rb
+++ b/lib/core/terraform_config/workload.rb
@@ -21,7 +21,7 @@ class Workload < Base
     ].freeze
 
     attr_reader :type, :name, :gvc, :containers,
-                :description, :tags, :support_dynamic_tags, :firewall_spec, :identity,
+                :description, :tags, :support_dynamic_tags, :firewall_spec, :identity_link,
                 :options, :local_options, :rollout_options, :security_options, :load_balancer, :job
 
     def initialize( # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
@@ -33,7 +33,7 @@ def initialize( # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
       tags: nil,
       support_dynamic_tags: false,
       firewall_spec: nil,
-      identity: nil,
+      identity_link: nil,
       options: nil,
       local_options: nil,
       rollout_options: nil,
@@ -52,7 +52,7 @@ def initialize( # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
 
       @containers = containers
       @firewall_spec = firewall_spec
-      @identity = identity
+      @identity_link = identity_link
 
       @options = options
       @local_options = local_options
@@ -71,7 +71,7 @@ def to_tf
         argument :type, type
         argument :name, name
         argument :gvc, gvc
-        argument :identity, identity, optional: true
+        argument :identity_link, identity_link, optional: true
         argument :support_dynamic_tags, support_dynamic_tags, optional: true
 
         RAW_ARGS.each { |arg_name| argument arg_name, send(:"#{arg_name}_arg"), raw: true, optional: true }
diff --git a/lib/core/terraform_config/workload/main.tf b/lib/core/terraform_config/workload/main.tf
index 38780f77..62565361 100644
--- a/lib/core/terraform_config/workload/main.tf
+++ b/lib/core/terraform_config/workload/main.tf
@@ -2,7 +2,7 @@ resource "cpln_workload" "workload" {
   type = var.type
 
   gvc = var.gvc
-  identity_link = var.identity != null ? var.identity.self_link : null
+  identity_link = var.identity_link
 
   name = var.name
   description = var.description
@@ -19,6 +19,7 @@ resource "cpln_workload" "workload" {
       args = container.value.args
       command = container.value.command
       env = container.value.envs
+      inherit_env = container.value.inherit_env
       image = container.value.image
 
       cpu = container.value.cpu
diff --git a/lib/core/terraform_config/workload/variables.tf b/lib/core/terraform_config/workload/variables.tf
index c5ed200b..4057d4a0 100644
--- a/lib/core/terraform_config/workload/variables.tf
+++ b/lib/core/terraform_config/workload/variables.tf
@@ -133,10 +133,8 @@ variable "gvc" {
   type = string
 }
 
-variable "identity" {
-  type = object({
-    self_link = string
-  })
+variable "identity_link" {
+  type = string
   default = null
 }
 
@@ -155,7 +153,7 @@ variable "load_balancer" {
   type = object({
     direct = optional(
       object({
-        enabled = number
+        enabled = bool
         port = optional(
           list(
             object({
diff --git a/spec/core/terraform_config/generator_spec.rb b/spec/core/terraform_config/generator_spec.rb
index 903f2323..33a4eefc 100644
--- a/spec/core/terraform_config/generator_spec.rb
+++ b/spec/core/terraform_config/generator_spec.rb
@@ -497,7 +497,7 @@
         }
       )
 
-      expect(main_tf_config.identity).to eq("cpln_identity.identity-name")
+      expect(main_tf_config.identity_link).to eq("//gvc/gvc-name/identity/identity-name")
       expect(main_tf_config.options).to eq(
         autoscaling: {
           max_concurrency: 0,
diff --git a/spec/core/terraform_config/gvc_spec.rb b/spec/core/terraform_config/gvc_spec.rb
index fd12b77e..e9b8f935 100644
--- a/spec/core/terraform_config/gvc_spec.rb
+++ b/spec/core/terraform_config/gvc_spec.rb
@@ -34,7 +34,7 @@
               }
               domain = "app.example.com"
               locations = ["aws-us-east-1", "aws-us-east-2"]
-              pull_secrets = ["cpln_secret.docker.name"]
+              pull_secrets = [cpln_secret.docker.name]
               env = {
                 var1 = "value"
                 var2 = 1
diff --git a/spec/core/terraform_config/workload_spec.rb b/spec/core/terraform_config/workload_spec.rb
index 6b433d43..a4ed93b5 100644
--- a/spec/core/terraform_config/workload_spec.rb
+++ b/spec/core/terraform_config/workload_spec.rb
@@ -9,7 +9,7 @@
       description: "main workload description",
       tags: { tag1: "tag1_value", tag2: "tag2_value" },
       gvc: "cpln_gvc.app-name.name",
-      identity: "cpln_identity.identity-name",
+      identity_link: "//gvc/gvc-name/identity/app-identity",
       type: type,
       support_dynamic_tags: true,
       containers: containers,
@@ -35,7 +35,7 @@ module "main" {
               type = "standard"
               name = "main"
               gvc = cpln_gvc.app-name.name
-              identity = cpln_identity.identity-name
+              identity_link = "//gvc/gvc-name/identity/app-identity"
               support_dynamic_tags = true
               containers = {
                 rails: {