基于Terraform实现AWS与Azure跨云Kubernetes部署：能否采用通用模板替代分云配置？

Absolutely—you can absolutely use a single kubernetes.tf file as a universal template to deploy Kubernetes clusters across both Azure and AWS with Terraform. The key is leveraging Terraform’s conditional logic and provider targeting features to avoid duplicating code. Here’s a step-by-step breakdown of how to make this work:

The idea is to use a variable to specify your target cloud provider, then use that variable to conditionally create cloud-specific Kubernetes cluster resources and configure the Kubernetes provider dynamically.

1. Define a Cloud Provider Switch Variable #

First, add a variable to your configuration (you can put this in variables.tf or directly in kubernetes.tf) to let you toggle between AWS and Azure:

variable "cloud_provider" {
  type        = string
  description = "Target cloud provider: either 'aws' or 'azure'"
  default     = "aws"
  validation {
    condition     = contains(["aws", "azure"], var.cloud_provider)
    error_message = "Valid values are 'aws' or 'azure'."
  }
}

2. Conditionally Create Cloud-Specific K8s Clusters #

In kubernetes.tf, wrap your AWS EKS and Azure AKS resources with count to only create the cluster for your target provider:

# AWS EKS Cluster (only created if cloud_provider is "aws")
resource "aws_eks_cluster" "main" {
  count = var.cloud_provider == "aws" ? 1 : 0

  name     = "my-eks-cluster"
  role_arn = aws_iam_role.eks_cluster_role.arn # Assume this is defined elsewhere
  version  = "1.28"

  vpc_config {
    subnet_ids = aws_subnet.private.*.id # Assume your VPC subnets are defined
  }
}

# Azure AKS Cluster (only created if cloud_provider is "azure")
resource "azurerm_kubernetes_cluster" "main" {
  count = var.cloud_provider == "azure" ? 1 : 0

  name                = "my-aks-cluster"
  location            = azurerm_resource_group.main.location # Assume your RG is defined
  resource_group_name = azurerm_resource_group.main.name
  dns_prefix          = "myakscluster"

  default_node_pool {
    name       = "default"
    node_count = 3
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type = "SystemAssigned"
  }
}

3. Dynamically Configure the Kubernetes Provider #

Next, configure the Kubernetes provider to point to whichever cluster you created. You’ll need to fetch authentication tokens for each cloud’s cluster:

# Fetch AWS EKS auth token (only runs for AWS)
data "aws_eks_cluster_auth" "main" {
  count = var.cloud_provider == "aws" ? 1 : 0
  name  = aws_eks_cluster.main[0].name
}

# Fetch Azure AKS auth token (only runs for Azure)
data "azurerm_kubernetes_cluster_auth" "main" {
  count = var.cloud_provider == "azure" ? 1 : 0
  name                = azurerm_kubernetes_cluster.main[0].name
  resource_group_name = azurerm_resource_group.main.name
}

# Kubernetes Provider (dynamic based on target cloud)
provider "kubernetes" {
  host = var.cloud_provider == "aws" ? aws_eks_cluster.main[0].endpoint : azurerm_kubernetes_cluster.main[0].kube_config.0.host

  cluster_ca_certificate = var.cloud_provider == "aws" 
    ? base64decode(aws_eks_cluster.main[0].certificate_authority.0.data) 
    : base64decode(azurerm_kubernetes_cluster.main[0].kube_config.0.cluster_ca_certificate)

  token = var.cloud_provider == "aws" 
    ? data.aws_eks_cluster_auth.main[0].token 
    : data.azurerm_kubernetes_cluster_auth.main[0].token
}

4. Add Common K8s Resources (Universal Across Clouds) #

Any standard Kubernetes resources (namespaces, deployments, services) can be added directly without conditions—they’ll deploy to whichever cluster is active:

# Universal Kubernetes Namespace
resource "kubernetes_namespace" "app" {
  metadata {
    name = "my-app-namespace"
  }
}

# Universal Deployment Example
resource "kubernetes_deployment" "app" {
  metadata {
    name      = "my-app"
    namespace = kubernetes_namespace.app.metadata[0].name
  }

  spec {
    replicas = 3
    selector {
      match_labels = {
        app = "my-app"
      }
    }

    template {
      metadata {
        labels = {
          app = "my-app"
        }
      }

      spec {
        container {
          image = "nginx:latest"
          name  = "nginx"
          port {
            container_port = 80
          }
        }
      }
    }
  }
}

• Conditional Provider Initialization: To prevent authentication errors from unconfigured providers (e.g., missing AWS credentials when targeting Azure), update your provider files to use count:
  • In aws_provider.tf:

    provider "aws" {
      count  = var.cloud_provider == "aws" ? 1 : 0
      region = "us-east-1" # Adjust to your region
    }
    

  • In azure_provider.tf:

    provider "azurerm" {
      count    = var.cloud_provider == "azure" ? 1 : 0
      features {}
    }
    

• Terraform Workspaces (Optional): For better organization, use Terraform workspaces to separate state for AWS and Azure deployments (e.g., terraform workspace new aws and terraform workspace new azure).
• Module Abstraction (Optional): If your configuration grows, you can refactor cloud-specific cluster logic into modules (e.g., modules/aws-eks and modules/azure-aks) and call them conditionally from kubernetes.tf—this keeps your main file clean while maintaining a single entry point.

Yes, your kubernetes.tf can absolutely act as a universal template. With conditional logic and dynamic provider configuration, you can deploy Kubernetes clusters to either AWS or Azure without maintaining separate templates for each cloud.

内容的提问来源于stack exchange，提问作者James001