kubernetes - 无法使用 terraform 检索 sa token

Question

我需要使用管道中的输出检索 SA token ，我在这里找到了解决方案

Retrieve token data from Kubernetes Service Account in Terraform

但仍然无法工作并收到此错误:

│ Error: Invalid function argument
│ 
│   on access.tf line 51, in output "deploy_user_token":
│   51:   value = lookup(data.kubernetes_secret.deploy_user_secret.data, "token")
│     ├────────────────
│     │ data.kubernetes_secret.deploy_user_secret.data has a sensitive value
│ 
│ Invalid value for "inputMap" parameter: argument must not be null.

我的代码:

resource "kubernetes_service_account" "deploy_user" {
  depends_on = [kubernetes_namespace.namespace]
  metadata {
    name      = "deploy-user"
    namespace = var.namespace
  }
}

resource "kubernetes_role" "deploy_user_full_access" {
  metadata {
    name      = "deploy-user-full-access"
    namespace = var.namespace
  }

  rule {
    api_groups = ["", "extensions", "apps", "networking.istio.io"]
    resources  = ["*"]
    verbs      = ["*"]
  }
  rule {
    api_groups = ["batch"]
    resources  = ["jobs", "cronjobs"]
    verbs      = ["*"]
  }
}

resource "kubernetes_role_binding" "deploy_user_view" {
  metadata {
    name      = "deploy-user-view"
    namespace = var.namespace
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = kubernetes_role.deploy_user_full_access.metadata.0.name
  }
  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.deploy_user.metadata.0.name
    namespace = var.namespace
  }
}

data "kubernetes_secret" "deploy_user_secret" {
  metadata {
    name = kubernetes_service_account.deploy_user.default_secret_name
  }
}

output "deploy_user_token" {
  value = lookup(data.kubernetes_secret.deploy_user_secret.data, "token")
}

有人知道我做错了什么吗？

谢谢!

Answer 1

您似乎缺少数据对象上的 namespace 声明，您需要它看起来像这样:

data "kubernetes_secret" "deploy_user_secret" {
  metadata {
    name = kubernetes_service_account.deploy_user.default_secret_name
    namespace = var.namespace
  }
}

您还需要在输出中设置sensitive = true:

output "deploy_user_token" {
  sensitive = true
  value = lookup(data.kubernetes_secret.deploy_user_secret.data, "token")
}