kubernetes 使用Terraform helm提供程序安装helm图表

vm0i2vca 于 2022-12-17 发布在 Kubernetes

关注(0)|答案(2)|浏览(260)

我尝试使用Terraform helm提供程序来部署一个helm图表。使用下面的代码，我可以创建一个helm版本，并为资源创建命名空间。

provider "helm" {

  kubernetes {

   kube_config_path = trim(base64decode(data.test.config.result.config_path), "\n")
exec {
api_version = "client.authentication.k8s.io/v1"
command     = "kubelogin"
args = [
  "get-token",
  "--login", "spn",
  "--environment", "AzurePublicCloud",
  "--server-id", "6dae42f8-4368-4678-94ff-3960e28e3630",
  "--tenant-id", data.azurerm_client_config.current.tenant_id,
  "--client-id", data.azurerm_client_config.current.client_id,
  "--client-secret",  data.azurerm_key_vault_secret.service_principal_key.value,
 ]
}

 }
   debug       = true
}

resource "helm_release" "helmrelname" {
 name = "helmrelname"

 repository       = "https://mycompany.github.io/charts"
 chart            = "helmrelname1"
 namespace        = "helmrelname-test"
create_namespace = true
timeout          = 800
wait_for_jobs    = true
wait             = true
force_update     = true
set {
name  = "helmrelname.monitoring.create"
value = "false"
type  = "auto"
}
depends_on = [data.test.config]

lifecycle {
ignore_changes = all
}
}

在“terraform apply”上，我可以看到执行失败，出现以下错误

query: failed to query with labels: secrets is forbidden: User "3df53t-3fea-48b4-a932-3061e1fec6cc" cannot list resource "secrets" in API group "" in the namespace "helmrelname-test"

我应该怎么做来解决这个问题？
注意：“3df 53 t-3fea-48 b4-a932- 3061 e1 fec 6cc”是服务主体对象标识

kubernetes

来源：https://stackoverflow.com/questions/74813837/installing-helm-chart-using-terraform-helm-provider

2条答案

按热度按时间

thtygnil1#

问题似乎是由服务主体权限引起的。已通过以下代码复制相同内容。

**步骤1：**通过运行以下命令创建了服务主体

az ad sp create-for-rbac -n "demo-helm"

输出如下

**步骤2：**主tf文件如下所示注：复制上述机密密码和appid信息

data "azurerm_resource_group" "example" {
  name     = "*********"
}
data "azuread_client_config" "current" {}

provider "helm" {

  kubernetes {

  // kube_config_path = trim(base64decode(data.test.config.result.config_path), "\n")
exec {
api_version = "client.authentication.k8s.io/v1"
command     = "kubelogin"
args = [
  "get-token",
  "--login", "spn",
  "--environment", "AzurePublicCloud",
  "--server-id", "*****************************",
  "--tenant-id", "*****************************",
  "--client-id", "*****************************",
  "--client-secret",  "*****************************",

 ]
}

 }
   debug       = true
}

resource "helm_release" "helmrelname" {
 name = "helmrelname"

 repository       = "https://mycompany.github.io/charts"
 chart            = "helmrelname1"
 namespace        = "helmrelname-test"
create_namespace = true
timeout          = 800
wait_for_jobs    = true
wait             = true
force_update     = true
set {
name  = "helmrelname.monitoring.create"
value = "false"
type  = "auto"
}
//depends_on = [data.test.config]

lifecycle {
ignore_changes = all
}
}

步骤3：运行计划和应用程序时

terraform plan
terraform apply -auto-approve

注意：我们需要在门户网站上配置有效的图表存储库访问权限。

赞(0）回复(0）举报 2022-12-17

pdtvr36n2#

已将群集管理员角色的群集角色绑定添加到对象ID“3df 53 t-3fea-48 b4-a932- 3061 e1 fec 6cc”，问题已得到解决。
使用命令。

kubectl create clusterrolebinding --clusterrole cluster-admin --user "3df53t-3fea-48b4-a932-3061e1fec6cc"

赞(0）回复(0）举报 2022-12-17

我来回答

kubernetes 使用Terraform helm提供程序安装helm图表

2条答案

相关问题

热门标签

最新问答