terraform kubernetes提供程序-未正确创建tls机密

Question

>

我通过terraform创建了一个自签名tls证书和私钥。这些文件称为服务器。密钥和服务器。crt

我用这个证书和私钥创建了一个kubernetes tls机密：kubectl create secret tls dpaas secret-n dpaas prod-key server。密钥--cert server.crt

这工作正常，nginx入口ssl终止工作，以下kubectl命令：kubectl get secret test secret-o yaml-n dpaas prod返回正确的tls输出。crt pem数据和tls。关键pem数据（请参阅下面步骤6中的正确输出）

由于我们使用terraform，我尝试通过terraform kubernetes提供程序在同一台服务器上创建相同的秘密。钥匙和服务器。crt文件。然而，这一次，命令：kubectl get secret test secret-o yaml-n dpaas prod返回crt pem和密钥pem的奇怪输出（请参阅下面步骤5中的输出），并且我的nginx入口上的ssl终止不起作用<这就是我如何通过terraform创建kubernetes秘密：

      resource "kubernetes_secret" "this" {
          metadata {
            name = "dpaas-secret"
            namespace = "dpaas-prod"
          }

          data = {
            "tls.crt" = "${path.module}/certs/server.crt"
            "tls.key" = "${path.module}/certs/server.key"
          }

          type = "kubernetes.io/tls"
       }  

    *apiVersion: v1
    data:
      tls.crt: bXktdGVzdHMvY2VydHMvc2VydmVyLmNydA==
      tls.key: bXktdGVzdHMvY2VydHMvc2VydmVyLmtleQ==
   `enter code here` kind: Secret
    metadata:
      creationTimestamp: "2019-12-17T16:18:22Z"
      name: dpaas-secret
      namespace: dpaas-prod
      resourceVersion: "9879"
      selfLink: /api/v1/namespaces/dpaas-prod/secrets/dpaas-secret
      uid: d84db7f0-20e8-11ea-aa92-1269ad9fd693
    type: kubernetes.io/tls*  

*apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR4RENDQXF5Z0F3SUJBZ0lRZGM0cmVoOHRQNFZPN3NkTWpzc1lTVEFOQmdrcWhraUc5dzBCQVFzRkFEQkUKTVJBd0RnWURWUVFLRXdkbGVHRnRjR3hsTVJRd0VnWURWUVFMRXd0bGVHRnRjR3hsS
UdSd2N6RWFNQmdHQTFVRQpBd3dSS2k1a2NITXVaWGhoYlhCc1pTNWpiMjB3SGhjTk1Ua3hNakUzTVRZeE5UVXpXaGNOTWpreE1qRTNNRE14Ck5UVXpXakJaTVFzd0NRWURWUVFHRXdKVlV6RVVNQklHQTFVRUNoTUxaWGhoYlhCc1pTQmtjSE14R0RBV0JnTlYKQkFzV
EQyVjRZVzF3YkdVdVpIQnpMbU52YlRFYU1CZ0dBMVVFQXd3UktpNWtjSE11WlhoaGJYQnNaUzVqYjIwdwpnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDaDU0enBwVTBod1hscm1qVXpOeVl0Ckp5WG9NSFU4WFpXTzhoVG9KZ09YUDU5N
nZFVmJQRXJlQ1VxM1BsZXB5SkRrcHNWbHo1WWc1TWp4NkVGTnlxNVQKOHVLUlVZUXNPVzNhd1VCbzM2Y3RLZEVvci8wa0JLNXJvYTYyR2ZFcHJmNVFwTlhEWnY3T1Y1YU9VVjlaN2FFTwpNNEl0ejJvNWFVYm5mdHVDZVdqKzhlNCtBS1phVTlNOTFCbFROMzFSUUFSR
3RnUzE4MFRzcVlveGV3YXBoS3FRCmUvTm5TeWF6ejUyTU5jeml6WTRpWXlRUU9EbUdEOEtWRGRJbWxJYXFoYXhiVGVTMldWZFJzdmpTa2xVZ0pGMUUKb2VWaWo1KytBd0FBczYwZkI2M1A4eFB1NEJ3cmdGTmhTV2F2ZXdJV1RMUXJPV1I2V2wvWTY1Q3lnNjlCU0xse
gpBZ01CQUFHamdad3dnWmt3RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CCkJnZ3JCZ0VGQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZPanRBdTJoNDN0WjhkS1YKaHUzc2xVS3VJYTlHTURrR0ExV
WRFUVF5TURDQ0VTb3VaSEJ6TG1WNFlXMXdiR1V1WTI5dGdoc3FMbVJ3Y3k1MQpjeTFsWVhOMExURXVaWGhoYlhCc1pTNWpiMjB3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUlxRVlubHdwQnEyCmNmSnhNUUl0alF4ZTlDK2FDTnZXS1VOZjlwajlhZ3V6YXNxTW9wU
URWTFc1dnZxU21FbHJrVXNBQzJPemZ3K2UKRkxKNUFvOFg3VFcxTHBqbk01Mm1FVjRZYUcvM05hVTg5dWhOb0FHd0ZPbU5TK3ZldU12N3RKQjhsUHpiQ1k3VApKaG9TL2lZVE9jUEZUN1pmNkVycjFtd1ZkWk1jbEZuNnFtVmxwNHZGZk1pNzRFWnRCRXhNaDV3aWU3Q
Wl4Z2tTCmZaVno4QUEzTWNpalNHWFB6YStyeUpJTnpYY0gvM1FRaVdLbzY5SUQrYUlSYTJXUUtxVlhVYmk0bmlZaStDUXcKeTJuaW5TSEVCSDUvOHNSWVZVS1ZjNXBPdVBPcFp0RmdqK1l6d1VsWGxUSytLRTR0R21Ed09teGxvMUNPdGdCUAorLzFXQWdBN1p0QT0KL
S0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBb2VlTTZhVk5JY0Y1YTVvMU16Y21MU2NsNkRCMVBGMlZqdklVNkNZRGx6K2ZlcnhGCld6eEszZ2xLdHo1WHFjaVE1S2JGWmMrV0lPVEk4ZWhCVGNxdVUvTGlrVkdFT
ERsdDJzRkFhTituTFNuUktLLzkKSkFTdWE2R3V0aG54S2EzK1VLVFZ3MmIremxlV2psRmZXZTJoRGpPQ0xjOXFPV2xHNTM3YmdubG8vdkh1UGdDbQpXbFBUUGRRWlV6ZDlVVUFFUnJZRXRmTkU3S21LTVhzR3FZU3FrSHZ6WjBzbXM4K2RqRFhNNHMyT0ltTWtFRGc1C
mhnL0NsUTNTSnBTR3FvV3NXMDNrdGxsWFViTDQwcEpWSUNSZFJLSGxZbytmdmdNQUFMT3RId2V0ei9NVDd1QWMKSzRCVFlVbG1yM3NDRmt5MEt6bGtlbHBmMk91UXNvT3ZRVWk1Y3dJREFRQUJBb0lCQUZaNjFqdmUvY293QytrNwozM3JSMUdSOTZyT1JYcTIxMXpNW
mY2MVkwTVl6Ujc1SlhrcVRjL0lSeUlVRW1kS292U3hGSUY5M2VGdHRtU0FOCnpRUCtaUXVXU3dzUUhhZDVyWUlSZzVRQkVzeis3eWZxaVM1NkNhaVlIamhLdHhScVNkTk5tSmpkSlBHV3UyYWQKZEc4V2pOYUhFTnZqVkh3Q0RjdU5hVGJTSHhFOTAwSjhGQTg0c3d2M
lZFUGhSbExXVjJudVpLTko5aGIrY2IzVQpsZ2JrTnVxMkFsd2Y3MkRaTVRXZ21DM3N1Z004eGYwbWFCRWV3UXdETVdBZis2dWV6MEJ5V0hLdThwNHZRREJvCjBqQVYzOGx6UHppTDU3UTZYbFdnYjIxWUh2QmJMSVVKcEFRMGdrcGthaEFNVmJlbHdiSDJVR25wOXcrb
zU3MnIKTmhWMFJXRUNnWUVBeEtFU3FRWEV5dmpwWU40MGxkbWNhTmdIdFd1d3RpUThMMWRSQitEYXBUbWtZbzFlWXJnWgpzNi9HbStRalFtNlU1cG04dHFjTm1nL21kTDJzdk9uV1Y1dnk5eThmZHo3OFBjOFlobXFJRE5XRE9tZG9wUVJsCmxsVUZ6S0NwRmVIVTJRW
URYYjBsNWNvZzYyUVFUaWZIdjFjUGplWlltc2I5elF0cDd6czJZMGtDZ1lFQTBzcFoKTWRRUUxiRkZkWDlYT05FU2xvQlp3Slg5UjFQZVA0T2F4eUt2a01jQXFFQ0Npa05ZU3FvOU55MkZQNVBmQlplQgpWbzYvekhHR0dqVkFPQUhBczA5My8zZUZxSFRleWVCSzhQR
kJWMHh5em9ZZThxYUhBR1JxVnpjS240Zy9LVjhWClpjVGMwTm5aQzB5b09NZkhYUTVnQm1kWnpBVXBFOHlqZzhucGV0c0NnWUVBd0ZxU1ZxYytEUkhUdk4ranNiUmcKUG5DWG1mTHZ2RDlXWVRtYUc0cnNXaFk1cWUrQ0ZqRGpjOVRSQmsvMzdsVWZkVGVRVlY2Mi82L
3VVdVg2eGhRNwppeGtVWnB2Q3ZIVHhiY1hheUNRUFUvN0xrYWIzeC9hMUtvdWlVTHdhclQxdmE1OW1TNTF1SlkzSEJuK3RNOGZXCnNHZ0szMVluOThJVEp6T3pQa1UrdjRFQ2dZQUpRQkFCKzhocCtPbVBhbk10Yng5ZHMydzg0MWdtRlN3ZnBXcloKYWxCQ0RqbWRLS
mVSOGJxaUxDNWJpWWZiYm1YUEhRTDBCWGV0UlI0WmNGVE5JR2FRZCtCUU9iS0gzZmtZNnRyZgpEL2RLR1hUQVUycHdRNWFSRWRjSTFNV0drcmdTM0xWWHJmZnl3bHlmL2xFempMRFhDSloyTVhyalZTYWtVOHFwCk1lY3BHUUtCZ0c0ZjVobDRtL1EvaTNJdGZJbGw4W
DFRazFUSXVDK0JkL1NGM0xVVW5JUytyODA4dzVuaTNCUnEKNXgvQjFnRUhZbTNjSTROajR5ZzEvcE1CejhPMk1PeFhVbVNVZVh6dit1MG5oOFQxUE96eDJHOTNZaVlOL0cvNQpjMlBMSFMvTTlmVjhkTEVXL0hBVFM3K0hsMDFGQlVlREhrODQrVXlha2V2ZFU2djdVZ
2ErCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
  creationTimestamp: "2019-12-17T16:16:56Z"
  name: dpaas-secret
  namespace: dpaas-prod
  resourceVersion: "9727"
  selfLink: /api/v1/namespaces/dpaas-prod/secrets/dpaas-secret
  uid: a5739134-20e8-11ea-a977-0a0ee9b505f9
type: kubernetes.io/tls*  

问题：为什么kubernetes秘密pem数据短（损坏？）在使用terraformhtml" target="_blank">添加秘密时<我们使用terraform版本0.12.8和kubernetes 1.13

为了再现这一点，这里有文件链接：

• 服务器。crt-https://drive.google.com/open?id=1vFakHWkx9JxyDAEzFE_5fJomEkmQQ7Wt

Answer 1

问题是您正在将证书文件的路径编码为机密，而不是文件的内容。

如果您对示例中的秘密字符串进行base64解码，您可以看到这种情况：

$ echo -n bXktdGVzdHMvY2VydHMvc2VydmVyLmNydA== | base64 -d
my-tests/certs/server.crt
$ echo -n bXktdGVzdHMvY2VydHMvc2VydmVyLmtleQ== | base64 -d
my-tests/certs/server.key

因此，与此相反：

data = {
    "tls.crt" = "${path.module}/certs/server.crt"
    "tls.key" = "${path.module}/certs/server.key"
}

执行以下操作：

data = {
    "tls.crt" = file("${path.module}/certs/server.crt")
    "tls.key" = file("${path.module}/certs/server.key")
}