Consul Helm安装报错：rbac.authorization.k8s.io/v1beta1无ClusterRole匹配

执行terraform apply时触发以下错误：

Error: unable to build kubernetes objects from release manifest: [resource mapping not found for name: "devt2-d1-***-consul-tls-init-cleanup" namespace: "devt2-d1" from "": no matches for kind "ClusterRole" in version "rbac.authorization.k8s.io/v1beta1"

环境版本信息 #

• Kubernetes EKS集群版本：1.23
• kubectl版本：

Client Version: version.Info{Major:"1", Minor:"24+", GitVersion:"v1.24.13-eks-0a21954", GitCommit:"6305d65c340554ad8b4d7a5f21391c9fa34932cb", GitTreeState:"clean", BuildDate:"2023-04-15T00:37:31Z", GoVersion:"go1.19.8", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.4
Server Version: version.Info{Major:"1", Minor:"23+", GitVersion:"v1.23.17-eks-a5565ad", GitCommit:"23f44c7dd4e8e23856387345e7cb80bf0f93ced6", GitTreeState:"clean", BuildDate:"2023-06-15T21:19:39Z", GoVersion:"go1.19.6", Compiler:"gc", Platform:"linux/amd64"}

• helm版本：

version.BuildInfo{Version:"v3.11.3", GitCommit:"323249351482b3bbfc9f5004f65d400aa70f9ae7", GitTreeState:"clean", GoVersion:"go1.20.3"}

• terraform版本：

Terraform v1.5.3

问题根因 #

查看Consul Chart目录下的consul/charts/common/templates/_capabilities.tpl文件，发现RBAC版本判断逻辑：

{{/*
Return the appropriate apiVersion for RBAC resources.
*/}}
{{- define "common.capabilities.rbac.apiVersion" -}}
{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}}
{{- print "rbac.authorization.k8s.io/v1beta1" -}}
{{- else -}}
{{- print "rbac.authorization.k8s.io/v1" -}}
{{- end -}}
{{- end -}}

由于EKS集群的版本号带有-eks-a5565ad后缀，semverCompare无法正确解析版本，错误触发了<1.17-0的判断，导致生成了已被Kubernetes 1.23废弃的rbac.authorization.k8s.io/v1beta1版本API。

解决方案 #

方案1：直接修改Chart模板 #

编辑consul/charts/common/templates/_capabilities.tpl，修改RBAC版本判断逻辑，强制使用v1版本：

{{/*
Return the appropriate apiVersion for RBAC resources.
*/}}
{{- define "common.capabilities.rbac.apiVersion" -}}
{{- print "rbac.authorization.k8s.io/v1" -}}
{{- end -}}

或者修正版本解析逻辑，去掉EKS后缀后再比较：

{{/*
Return the appropriate apiVersion for RBAC resources.
*/}}
{{- define "common.capabilities.rbac.apiVersion" -}}
{{- $rawKubeVersion := include "common.capabilities.kubeVersion" . -}}
{{- $cleanKubeVersion := regexReplaceAll "-.*" $rawKubeVersion "" -}}
{{- if semverCompare "<1.17" $cleanKubeVersion -}}
{{- print "rbac.authorization.k8s.io/v1beta1" -}}
{{- else -}}
{{- print "rbac.authorization.k8s.io/v1" -}}
{{- end -}}
{{- end -}}

方案2：通过Terraform强制设置RBAC版本 #

在Terraform的helm_release资源中添加set参数，直接指定RBAC API版本：

resource "helm_release" "consul" {
  name       = "consul"
  repository = "https://charts.bitnami.com/bitnami"
  chart      = "consul"
  version    = "10.12.6"
  namespace  = "devt2-d1"

  set {
    name  = "common.capabilities.rbac.apiVersion"
    value = "rbac.authorization.k8s.io/v1"
  }

  # 其他配置...
}

方案3：升级Consul Chart版本 #

该版本号解析问题大概率在后续Chart版本中已修复，可尝试升级到更高版本的Bitnami Consul Chart，避免手动修改模板。

内容的提问来源于stack exchange，提问作者swapnil