如何在Terraform中用for_each循环处理Vault KV对生成容器环境变量？

架构老林

2026-7-23

解决Vault KV转Nomad容器环境变量的方案

1. 确认Vault KV数据获取配置

先确保Terraform已正确拉取Vault的KV数据，示例配置如下：

data "vault_kv_secret_v2" "app_secrets" {
  mount_path = "kv"
  name       = "some/path/secrets"
}

# 提取KV存储的键值对map
locals {
  app_env_vars = data.vault_kv_secret_v2.app_secrets.data
}

2. 生成环境变量格式字符串

用Terraform的for表达式和join函数，把map转成KEY=VALUE格式的多行字符串：

locals {
  env_file_content = join("\n", [for k, v in local.app_env_vars : "${k}=${v}"])
}

3. 在tftpl模板中插入环境变量

假设你的job.tftpl是Nomad作业模板，有两种注入方式可选：

方式一：直接注入容器环境变量

job "my-app" {
  datacenters = ["dc1"]
  group "app" {
    task "server" {
      driver = "docker"
      config {
        image = "my-app-image:latest"
      }
      env {
        %{ for k, v in app_env_vars ~}
        ${k} = "${v}"
        %{ endfor ~}
      }
    }
  }
}

方式二：生成.env文件挂载

job "my-app" {
  datacenters = ["dc1"]
  group "app" {
    task "server" {
      driver = "docker"
      config {
        image = "my-app-image:latest"
      }
      template {
        data        = <<EOF
${env_file_content}
EOF
        destination = "local/.env"
        env         = true
      }
    }
  }
}

4. 渲染模板并部署

在Terraform中用templatefile渲染模板，传入变量后部署Nomad作业：

resource "nomad_job" "my_app" {
  jobspec = templatefile("${path.module}/job.tftpl", {
    app_env_vars     = local.app_env_vars
    env_file_content = local.env_file_content
  })
}