使用Terraform在Vault子路径创建密钥时误删UAT密钥的问题

我是HashiCorp Vault和Terraform的新手，Vault的kv/data/pipeline/synapse-cdo/uat/路径下已有名为UAT的密钥，想在kv/data/pipeline/synapse-cdo/dev/子路径新增密钥，但执行Terraform时，UAT密钥被删除，只部署了dev密钥。

我的Terraform代码 #

resource "vault_kv_secret_v2" "deploynewsecrets" 
{  
mount = var.mountpoint name = "pipeline/synapse-cdo/dev/" 
data_json = jsonencode 
          ({ "appid" = "bnasoirhol748975" 
             "secretid" = "naihpoiepsoiporihtpeoi6547838399"
          }) 
}

状态刷新日志 #

vault_kv_secret_v2.deploynewsecrets: Refreshing state... [id=kv/data/pipeline/synapse-cdo/uat/]

Terraform执行计划 #

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

# vault_kv_secret_v2.deploynewsecrets must be replaced

-/+ resource "vault_kv_secret_v2" "deploynewsecrets" {
~ data                = (sensitive value)
~ id                  = "kv/data/pipeline/synapse-cdo/uat/" -> (known after apply)
~ metadata            = {
- "created_time"    = "2024-11-02T06:03:23.7875518Z"
- "custom_metadata" = "null"
- "deletion_time"   = null
- "destroyed"       = "false"
- "version"         = "1"
} -> (known after apply)
~ name                = "pipeline/synapse-cdo/uat/" -> "pipeline/synapse-cdo/dev/" # forces replacement
~ path                = "kv/data/pipeline/synapse-cdo/uat/" -> (known after apply)
# (4 unchanged attributes hidden)

      - custom_metadata {
          - cas_required         = false -> null
          - data                 = {} -> null
          - delete_version_after = 0 -> null
          - max_versions         = 0 -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

原因及解决方法 #

原因 #

Terraform是声明式工具，vault_kv_secret_v2资源的name字段是唯一标识。你的Terraform状态文件中，deploynewsecrets资源之前对应UAT路径。当你修改name为dev路径时，Terraform判定原UAT资源不符合当前配置，会销毁它并创建新的dev资源。

解决方法 #

方案1：同时管理UAT和dev密钥

如果需要用Terraform维护两个密钥，需定义两个独立的vault_kv_secret_v2资源：

# 管理现有UAT密钥
resource "vault_kv_secret_v2" "uat_secret" {
  mount     = var.mountpoint
  name      = "pipeline/synapse-cdo/uat/"
  data_json = jsonencode({
    # 填入UAT密钥的实际数据，保持与Vault中现有值一致
    "appid"    = "原UAT的appid"
    "secretid" = "原UAT的secretid"
  })
}

# 新增dev密钥
resource "vault_kv_secret_v2" "dev_secret" {
  mount     = var.mountpoint
  name      = "pipeline/synapse-cdo/dev/"
  data_json = jsonencode({
    "appid"    = "bnasoirhol748975"
    "secretid" = "naihpoiepsoiporihtpeoi6547838399"
  })
}

方案2：仅用Terraform管理dev密钥，保留Vault中的UAT密钥

如果UAT密钥不需要Terraform管理，先移除Terraform状态中对UAT资源的记录：

terraform state rm vault_kv_secret_v2.deploynewsecrets

之后执行terraform plan和terraform apply，Terraform会创建dev密钥，不会影响Vault中的UAT密钥。

内容的提问来源于stack exchange，提问作者Niranjan Reddy Mopuri