使用 terraform 部署应用程序找不到我的服务帐户密码

Question

实际上是否可以在 terraform 部署的应用程序中使用 kubernates 机密。我看到了一些奇怪的行为。

我定义了一个具有适当节点池、配置映射和机密的集群。密钥包含服务帐户密钥 json 数据。 然后我可以使用kubectl apply -f myapp-deploy.yaml 部署我的应用程序，它工作正常。这告诉我集群一切都很好，包括秘密和配置。 但是，当我尝试使用 terraform 进行部署时，我收到了一个看起来像服务帐户提取的错误：

2019-07-19 06:20:45.497  INFO [myapp,,,] 1 --- [main] b.c.PropertySourceBootstrapConfiguration : Located property source: SecretsPropertySource {name='secrets.myapp.null'} 
2019-07-19 06:20:45.665  WARN [myapp,,,] 1 --- [main] io.fabric8.kubernetes.client.Config      : Error reading service account token from: [/var/run/secrets/kubernetes.io/serviceaccount/token]. Ignoring.
2019-07-19 06:20:45.677  INFO [myapp,,,] 1 --- [main] n.c.m.s.myappApplication          : The following profiles are active: test-dev

中间那一行很有意思，它似乎是在尝试从错误的地方读取服务帐号。

我已经将我的 yaml 文件中的相关设置转移到我的 tf 文件中，但也许我错过了一些东西。 yaml 文件如下所示：

...
          env:
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: "/var/run/secret/cloud.google.com/myapp-sa.json"
          volumeMounts:
            - name: "service-account"
              mountPath: "/var/run/secret/cloud.google.com"
          ports:
            - containerPort: 8080
      volumes:
        - name: "service-account"
          secret:
            secretName: "myapp"
...

而且这个 yaml 基本上可以正常工作。 现在我的 tf 文件中的等效项如下所示：

...
          env {
            name  = "GOOGLE_APPLICATION_CREDENTIALS"
            value = "/var/run/secret/cloud.google.com/myapp-sa.json"
          }
          volume_mount {
            name       = "myapp-sa"
            mount_path = "/var/run/secret/cloud.google.com"
            sub_path = ""
          }
        }
        volume {
          name = "myapp-sa"
          secret {
            secret_name = "myapp"
          }
        }
...

这给出了上述错误。它似乎决定在/var/run/secrets/kubernetes.io/serviceaccount/token 中查找服务帐户令牌，而不是我告诉它的位置。但仅当由 terraform 部署时。我正在部署相同的映像，并使用相同的 configmap 进入同一个集群。我的 tf 某处有问题。我尝试从 yaml 部署导入，但看不到任何我错过的重要内容。

FWIW 这是在 GKE 上运行的 Spring Boot 应用程序。

希望有人知道答案。

感谢您的帮助。

更多信息：我打开了 io.fabric8.kubernetes 的调试并重新运行了两个场景，即 terraform 和 yaml 文件。以下是相关的日志sn-ps：

地形：

2019-07-23 23:03:39.189 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client from Kubernetes config...
2019-07-23 23:03:39.268 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Did not find Kubernetes config at: [/root/.kube/config]. Ignoring.
2019-07-23 23:03:39.274 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client from service account...
2019-07-23 23:03:39.274 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Found service account host and port: 10.44.0.1:443
2019-07-23 23:03:39.282 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Did not find service account ca cert at: [/var/run/secrets/kubernetes.io/serviceaccount/ca.crt].
2019-07-23 23:03:39.285  WARN [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Error reading service account token from: [/var/run/secrets/kubernetes.io/serviceaccount/token]. Ignoring.
2019-07-23 23:03:39.291 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client namespace from Kubernetes service account namespace path...
2019-07-23 23:03:39.295 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Did not find service account namespace at: [/var/run/secrets/kubernetes.io/serviceaccount/namespace]. Ignoring.

Yaml：

2019-07-23 23:14:53.374 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client namespace from Kubernetes service account namespace path...
2019-07-23 23:14:53.375 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Found service account namespace at: [/var/run/secrets/kubernetes.io/serviceaccount/namespace].
2019-07-23 23:14:53.376 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client from Kubernetes config...
2019-07-23 23:14:53.377 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Did not find Kubernetes config at: [/root/.kube/config]. Ignoring.
2019-07-23 23:14:53.378 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client from service account...
2019-07-23 23:14:53.378 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Found service account host and port: 10.44.0.1:443
2019-07-23 23:14:53.383 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Found service account ca cert at: [/var/run/secrets/kubernetes.io/serviceaccount/ca.crt].
2019-07-23 23:14:53.384 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Found service account token at: [/var/run/secrets/kubernetes.io/serviceaccount/token].
2019-07-23 23:14:53.384 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Trying to configure client namespace from Kubernetes service account namespace path...
2019-07-23 23:14:53.384 DEBUG [snakecharmer,,,] 1 --- [           main] io.fabric8.kubernetes.client.Config      : Found service account namespace at: [/var/run/secrets/kubernetes.io/serviceaccount/namespace].

看起来 yaml 部署在 /var/run/secrets/kubernetes.io/serviceaccount/ca.crt 等处找到了它需要的内容，而 terraform 部署却没有。好像有一个幻影卷安装在** terraform**中丢失了

Answer 1

我找到了解决办法。 terraform 部署添加了 automount_service_account_token = false，但 yaml 默认为 true，这一切都不同。

开关位于我的 tf 文件中 kubernetes_deployment 的 template.spec 部分，现在看起来像这样 sn-p：

...
      spec {
        restart_policy = "Always"
        automount_service_account_token = true
        container {
          port {
            container_port = 8080
            protocol       = "TCP"
          }
...

设置automount_service_account_token = true 是解决方法，它可以很好地解决。