Question

我正在尝试在kubernetes集群和terraform云中创建一个秘密。我可以毫无问题地创建集群，但是当我尝试在集群中注入秘密时会出现问题。这是我的地形清单的简化版本：

terraform {
  backend "remote" {
    organization = "my-org"

    // Workspaces separate deployment envs (like prod, stage, or UK, Italy)
    workspaces {
      name = "my-workspace-name"
    }
  }
}
resource "google_container_cluster" "demo-k8s-cluster" {
  name = "demo-cluster"
  location = var.region
  initial_node_count = 1
  project = var.project-id


  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }

  node_config {
    oauth_scopes = [
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
    ]

//    service_account = var.service-account

    metadata = {
      disable-legacy-endpoints = "true"
    }
  }

  timeouts {
    create = "30m"
    update = "40m"
  }
}

provider "kubernetes" {
  host     = google_container_cluster.demo-k8s-cluster.endpoint
  username = google_container_cluster.demo-k8s-cluster.master_auth.0.username
  password = google_container_cluster.demo-k8s-cluster.master_auth.0.password
  client_certificate     = base64decode(google_container_cluster.demo-k8s-cluster.master_auth.0.client_certificate)
  client_key             = base64decode(google_container_cluster.demo-k8s-cluster.master_auth.0.client_key)
  cluster_ca_certificate = base64decode(google_container_cluster.demo-k8s-cluster.master_auth.0.cluster_ca_certificate)
  load_config_file = "false"
}

resource "kubernetes_secret" "cloudsql-db-credentials" {
   metadata {
       name = "cloudsql-instance-credentials-test"
   }

  data = {
    "stack-creds.json" = var.service-account
  }

}

该计划运行良好，在Apply阶段出现以下错误：

Error: secrets is forbidden: User "system:anonymous" cannot create resource "secrets" in API group "" in the namespace "default"

  on infrastructure.tf line 149, in resource "kubernetes_secret" "cloudsql-db-credentials":
 149: resource "kubernetes_secret" "cloudsql-db-credentials" {

Answer 1

根据@mario的评论，事实证明terraform cloud无法获得正确的身份，并且无法连接到集群以注入秘密。我没有使用terraform云，而是选择使用GCS后端并设法使其工作。以下配置有效：

terraform {
  backend "gcs" {
    bucket = "infrastructure-state-bucket"
    prefix = "test/so_simple2"
  }
}

// The project-id variable contains project id to use.
variable "project-id" {
  type = string
}

variable "region" {
  type = string
}

variable "cluster-name" {
  type = string
}

provider "google" {
  project = var.project-id
  region = var.region
}

provider "random" {}

resource "random_id" "id" {
  byte_length = 4
  prefix      = "${var.cluster-name}-"
}


resource "google_container_cluster" "cluster" {
  name = random_id.id.hex
  location = var.region
  initial_node_count = 1
  project = var.project-id
}

provider "kubernetes" {
  host     = google_container_cluster.cluster.endpoint
  username = google_container_cluster.cluster.master_auth.0.username
  password = google_container_cluster.cluster.master_auth.0.password
  client_certificate     = base64decode(google_container_cluster.cluster.master_auth.0.client_certificate)
  client_key             = base64decode(google_container_cluster.cluster.master_auth.0.client_key)
  cluster_ca_certificate = base64decode(google_container_cluster.cluster.master_auth.0.cluster_ca_certificate)
// This is a deal breaker, if is set to false I get same error.
//  load_config_file = "false"
}

resource "kubernetes_secret" "example" {
  metadata {
    name = "basic-auth"
  }

  data = {
    username = "admin"
    password = "P4ssw0rd"
  }

  type = "kubernetes.io/basic-auth"
}

无法使用Terraform Cloud在Kubernetes中创建秘密

1 个答案: