我想建立一个EKS集群，使其他IAM用户能够连接并修补该集群。为此，AWS建议修补一个配置图，我也这么做了。现在我想使用地形来启用相同的"功能"。
我使用terraforms EKS提供者，并阅读了"；由于工具过多；基本上身份验证取决于我自己。
现在我使用Terraform Kubernetes提供程序来更新这个配置图：
resource "kubernetes_config_map" "aws_auth" {
depends_on = [module.eks.cluster_id]
metadata {
name = "aws-auth"
namespace = "kube-system"
}
data = THATS_MY_UPDATED_CONFIG
}
但是不要成功并得到以下错误：
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: 2022/01/07 15:49:55 [DEBUG] Kubernetes API Response Details:
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: ---[ RESPONSE ]--------------------------------------
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: HTTP/2.0 409 Conflict
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Content-Length: 206
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Audit-Id: 15....
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Cache-Control: no-cache, private
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Content-Type: application/json
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Date: Fri, 07 Jan 2022 14:49:55 GMT
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: X-Kubernetes-Pf-Flowschema-Uid: f43...
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: X-Kubernetes-Pf-Prioritylevel-Uid: 0054...
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: {
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "kind": "Status",
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "apiVersion": "v1",
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "metadata": {},
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "status": "Failure",
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "message": "configmaps "aws-auth" already exists",
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "reason": "AlreadyExists",
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "details": {
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "name": "aws-auth",
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "kind": "configmaps"
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: },
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: "code": 409
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: }
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: -----------------------------------------------------
2022-01-07T15:49:55.775+0100 [ERROR] vertex "module.main.module.eks.kubernetes_config_map.aws_auth" error: configmaps "aws-auth" already exists
╷
│ Error: configmaps "aws-auth" already exists
│
│ with module.main.module.eks.kubernetes_config_map.aws_auth,
│ on ../../modules/eks/eks-iam-map-users.tf line 44, in resource "kubernetes_config_map" "aws_auth":
│ 44: resource "kubernetes_config_map" "aws_auth" {
│
╵
这似乎是一个有争议的问题，因为每个使用EKS和Terraform的人都应该有它——我问自己如何解决这个问题？相关问题，我很接近。。。。我有点迷路了，有人知道吗？
我使用以下版本：
terraform {
required_providers {
# https://registry.terraform.io/providers/hashicorp/aws/latest
aws = {
source = "hashicorp/aws"
version = "~> 3.70"
}
# https://registry.terraform.io/providers/hashicorp/kubernetes/latest
kubernetes = {
source = "hashicorp/kubernetes"
version = "~> 2.7.1"
}
required_version = ">= 1.1.2"
}
...
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "18.0.3"
...
我使用17.2.4，不知道18.0.3有什么新功能。
在我的案例中，我以这个例子为例：https://github.com/terraform-aws-modules/terraform-aws-eks/blob/v17.24.0/examples/complete/main.tf
我的主.tf
locals {
eks_map_roles = []
eks_map_users = []
}
data "aws_eks_cluster" "cluster" {
name = module.eks.cluster_id
}
data "aws_eks_cluster_auth" "cluster" {
name = module.eks.cluster_id
}
provider "kubernetes" {
host = data.aws_eks_cluster.cluster.endpoint
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
token = data.aws_eks_cluster_auth.cluster.token
}
module "eks" {
source = "..."
...
eks_map_roles = local.eks_map_roles
eks_map_users = local.eks_map_users
...
}
要添加另一个用户，您可以按照以下文档操作：https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/
我认为你应该添加角色(别忘了删除路径(。
map_users在eks模块的v18.x中已弃用
Support for managing aws-auth configmap has been removed. This change also removes the dependency on the Kubernetes Terraform provider, the local dependency on aws-iam-authenticator for users, as well as the reliance on the forked http provider to wait and poll on cluster creation. To aid users in this change, an output variable aws_auth_configmap_yaml has been provided which renders the aws-auth configmap necessary to support at least the IAM roles used by the module (additional mapRoles/mapUsers definitions to be provided by users)
假设您允许EKS模块为您创建配置映射，建议使用IMO，因为它允许您独立操作aws_auth配置映射。
创建一个本地变量，如下所示，它首先提取Terraform EKS模块正在创建的默认aws_auth-configmap。然后根据需要添加角色学习和组映射。
locals {
# Creating the AWS-AUTH
aws_auth_configmap_yaml = <<-EOT
${chomp(module.eks.aws_auth_configmap_yaml)}
- rolearn: arn:aws:iam::${data.aws_caller_identity.current.id}:role/RoleName
username: admin
groups:
- system:masters
EOT
}
然后使用创建一个kubectl_manifest资源https://registry.terraform.io/providers/gavinbunney/kubectl/latest
resource "kubectl_manifest" "aws_auth" {
yaml_body = <<YAML
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/managed-by: Terraform
name: aws-auth
namespace: kube-system
${local.aws_auth_configmap_yaml}
YAML
depends_on = [module.eks]
}