无法为GKE集群绑定标签的Terraform配置问题排查

问题场景 #

尝试为GKE集群绑定标签时Terraform执行失败，报错信息如下：

google_tags_tag_binding.gke-tag-value-binding: Creating...
╷
│ Error: Error creating TagBinding: googleapi: Error 400: Request contains an invalid argument.
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.BadRequest",
│     "fieldViolations": [
│       {
│         "description": "Must be a valid One Platform resource name of a tag-compatible global resource. Did you forget to specify the correct location?",
│         "field": "binding.resource"
│       },
│       {
│         "description": "Resource type not supported in location global",
│         "field": "binding.resource"
│       }
│     ]
│   }
│ ]
│ 
│   with google_tags_tag_binding.gke-tag-value-binding,
│   on main.tf line 162, in resource "google_tags_tag_binding" "gke-tag-value-binding":
│  162: resource "google_tags_tag_binding" "gke-tag-value-binding" {
│ 
╵

Terraform执行计划输出：

Terraform will perform the following actions:

  # google_tags_tag_binding.gke-tag-value-binding will be created
  + resource "google_tags_tag_binding" "gke-tag-value-binding" {
      + id        = (known after apply)
      + name      = (known after apply)
      + parent    = "//container.googleapis.com/projects/xxx/locations/asia-southeast2-a/clusters/gke-cluster"
      + tag_value = "tagValues/xxx"
    }

相关Terraform代码：

resource "google_tags_tag_key" "gke-tag" {
    parent      = "projects/${var.gcp-proj}"
    short_name  = "gke-cluster"
    description = ""
}

resource "google_tags_tag_value" "gke-tag-value" {
    parent = google_tags_tag_key.gke-tag.id
    short_name = "gke-cluster-true"
    description = "It's True"
}

resource "google_tags_tag_binding" "gke-tag-value-binding" {
    provider = google.oprek
    parent = "//container.googleapis.com/${google_container_cluster.gke-cluster.id}"
    tag_value = google_tags_tag_value.gke-tag-value.id
}

问题原因 #

报错核心是：GKE集群是区域资源，但使用了仅支持全局资源的google_tags_tag_binding资源。

google_tags_tag_binding是全局级别的标签绑定资源，仅适用于项目、全局存储桶等全局GCP资源；而GKE集群属于区域资源，必须使用对应区域的标签绑定资源才能完成操作，否则会触发"全局位置不支持该资源类型"的错误。

解决方案 #

改用区域化的标签绑定资源google_tags_tag_binding_location，并指定与GKE集群一致的区域：

resource "google_tags_tag_key" "gke-tag" {
    parent      = "projects/${var.gcp-proj}"
    short_name  = "gke-cluster"
    description = ""
}

resource "google_tags_tag_value" "gke-tag-value" {
    parent = google_tags_tag_key.gke-tag.id
    short_name = "gke-cluster-true"
    description = "It's True"
}

# 替换为区域化标签绑定资源，指定集群所在区域
resource "google_tags_tag_binding_location" "gke-tag-value-binding" {
    provider = google.oprek
    location = google_container_cluster.gke-cluster.location # 继承集群的区域参数
    parent = "//container.googleapis.com/${google_container_cluster.gke-cluster.id}"
    tag_value = google_tags_tag_value.gke-tag-value.id
}

关键修正点 #

1. 替换资源类型：将google_tags_tag_binding改为google_tags_tag_binding_location，该资源专门用于区域/多区域资源的标签绑定
2. 添加location参数：指定与GKE集群相同的区域（直接从集群资源继承可避免手动输入错误）

内容的提问来源于stack exchange，提问作者Jesaya Fernando Napitupulu