动态创建一个配置文件，并使用terraform将其添加为k8s中的配置映射

Question

我想使用地形动态生成一个sudoers文件，这里的用户名将根据需求进行更改。

所以我的最终sudoers文件应该如下所示。

Sudoers文件：

# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
Cmnd_Alias USRCMDS = /usr/sbin/service ssh restart, /usr/bin/passwd
# User privilege specification
root    ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
**<username1>** ALL=(root) NOPASSWD: /usr/sbin/service ssh restart, /usr/bin/passwd **<username1>**
**<username2>** ALL=(root) NOPASSWD: /usr/sbin/service ssh restart, /usr/bin/passwd **<username2>**
**<username3>** ALL=(root) NOPASSWD: /usr/sbin/service ssh restart, /usr/bin/passwd **<username3>**

正如您在上面的文件中看到的，用户名1,2，3等作为一个变量传递给terraform脚本(这些用户名是字符串列表，这些用户从外部传递给tf(。

使用tpl生成这个sudoers文件并使用terraform创建一个k8s配置图，我很累。

我尝试了以下代码片段来实现这一点，但它不起作用。

.tf文件：

data "template_file" "sudoers" {
count = "${length(var.members_new)}"
template = "${file("${path.module}/tpl/sudoers.tpl")}"
vars = {
members  = "${var.members_new[count.index % length(var.members_new)]}"
}
}

resource "kubernetes_config_map" "f1ai_sudoers" {
count = "${length(var.members_new)}"
depends_on = [ helm_release.project ]
metadata {
name = "sudoers-cm"
namespace = kubernetes_namespace.project.metadata.0.name
}

data = {
"sudoers" = data.template_file.sudoers.rendered
}
}

值。tf:

variable "members_new" {
type = list
default = ["username1", "username2", "username3"]
}

请帮助建议实现此功能的最佳方式。

Answer 1

我得到了它的解决方案。这可以通过使用kubernetes_config_maptf资源和EOF的组合来实现。

请在下面找到工作代码片段。

resource "kubernetes_config_map" "f1ai_sudoers" {
depends_on = [ helm_release.project ]
metadata {
name = "sudoers-cm"
namespace = kubernetes_namespace.project.metadata.0.name
}
data = {
"sudoers" = <<EOF
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
Cmnd_Alias USRCMDS = /usr/sbin/service ssh restart, /usr/bin/passwd
# User privilege specification
root    ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL
#includedir /etc/sudoers.d
%{ for username in var.members_new ~}
${username} ALL=(root) NOPASSWD: /usr/sbin/service ssh restart, /usr/bin/passwd ${username}
%{ endfor ~}
EOF
}
}