K8s v1.24+下Terraform workload-identity模块default_secret_name警告问题

架构老林

2026-7-24

问题

使用Terraform的workload-identity模块在Google Cloud中创建Kubernetes服务账号时，执行变更操作收到如下警告：

"default_secret_name" is no longer applicable for Kubernetes v1.24.0 and above

提示从Kubernetes 1.24.0版本开始，系统不再自动为服务账号生成令牌，此时default_secret_name字段会为空。我已尝试添加kubernetes_secret_v1资源来手动创建服务账号令牌，但警告依然存在。当前使用的main.tf代码如下：

locals {
  service_account_tmp = var.google_service_account_email== "" ? "projects/${var.project_id}/serviceAccounts/cloudsql-sa@${var.project_id}.iam.gserviceaccount.com" : var.google_service_account_email
  service_id = "projects/${var.project_id}/serviceAccounts/cloudsql-sa@${var.project_id}.iam.gserviceaccount.com"
  k8s_sa_gcp_derived_name = "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]"
  gcp_sa_email            = var.google_service_account_email

  # This will cause terraform to block returning outputs until the service account is created
  k8s_given_name       = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
  output_k8s_name      = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account.main[0].metadata[0].name
  output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account.main[0].metadata[0].namespace
}

# resource "google_service_account" "cluster_service_account" {
  # GCP service account ids must be < 30 chars matching regex ^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$
  # KSA do not have this naming restriction.
  # account_id   = substr(var.name, 0, 30)
  # display_name = substr("GCP SA bound to K8S SA ${local.k8s_given_name}", 0, 100)
  # project      = var.project_id
# }
resource "kubernetes_namespace" "k8s_namespace" {
  metadata {
    name = var.namespace
  }
}

# resource "kubernetes_secret_v1" "main" {
#  metadata {
#    name      = var.name
#    namespace = var.namespace
#    annotations = {
#      "kubernetes.io/service-account.name"      = kubernetes_service_account_v1.main.metadata.0.name
#      "kubernetes.io/service-account.namespace" = kubernetes_service_account_v1.main.metadata.0.namespace
#    }
#    generate_name = "${kubernetes_service_account_v1.main.metadata.0.name}-token-"
#  }
#  type = "kubernetes.io/service-account-token"
#  wait_for_service_account_token = true
#}

resource "kubernetes_service_account" "main" {
  count = var.use_existing_k8s_sa ? 0 : 1
  metadata {
    name      = var.name
    namespace = var.namespace
    annotations = {
      "iam.gke.io/gcp-service-account" = var.google_service_account_email
    }
  }
}


module "annotate-sa" {
  source  = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
  version = "~> 2.0.2"

  enabled          = var.use_existing_k8s_sa && var.annotate_k8s_sa
  skip_download    = true
  cluster_name     = var.cluster_name
  cluster_location = var.location
  project_id       = var.project_id

  kubectl_create_command  = "kubectl annotate --overwrite sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account=${local.gcp_sa_email}"
  kubectl_destroy_command = "kubectl annotate sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account-"
}

resource "google_service_account_iam_member" "main" {
  service_account_id = local.service_id
  role               = "roles/iam.workloadIdentityUser"
  member             = local.k8s_sa_gcp_derived_name
}

解决方法

这个警告的根源是：Kubernetes 1.24+不再自动为服务账号生成默认令牌，但旧版本的Terraform Kubernetes Provider仍会尝试读取default_secret_name字段，导致警告出现。要解决这个问题，需按以下步骤操作：

升级Terraform Kubernetes Provider
确保使用的Kubernetes Provider版本不低于2.11.0，新版本已适配K8s 1.24+的令牌生成逻辑，不会再触发该警告。
修正kubernetes_secret_v1资源配置
之前的配置存在两处问题：

引用了不存在的kubernetes_service_account_v1.main资源，实际应该关联kubernetes_service_account.main[0]（因为你的KSA资源使用了count参数）
同时指定了name和generate_name字段，这两个字段不能共存，需移除name字段

修正后的kubernetes_secret_v1资源如下：

resource "kubernetes_secret_v1" "main" {
  count = var.use_existing_k8s_sa ? 0 : 1
  metadata {
    namespace = var.namespace
    annotations = {
      "kubernetes.io/service-account.name"      = kubernetes_service_account.main[0].metadata[0].name
      "kubernetes.io/service-account.namespace" = kubernetes_service_account.main[0].metadata[0].namespace
    }
    generate_name = "${kubernetes_service_account.main[0].metadata[0].name}-token-"
  }
  type = "kubernetes.io/service-account-token"
  wait_for_service_account_token = true
}

更新关联逻辑
确保所有依赖服务账号令牌的地方，都引用新创建的kubernetes_secret_v1.main资源，而非依赖已失效的default_secret_name字段。

修改后的完整main.tf代码

locals {
  service_account_tmp = var.google_service_account_email == "" ? "projects/${var.project_id}/serviceAccounts/cloudsql-sa@${var.project_id}.iam.gserviceaccount.com" : var.google_service_account_email
  service_id = "projects/${var.project_id}/serviceAccounts/cloudsql-sa@${var.project_id}.iam.gserviceaccount.com"
  k8s_sa_gcp_derived_name = "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${local.output_k8s_name}]"
  gcp_sa_email            = var.google_service_account_email

  # This will cause terraform to block returning outputs until the service account is created
  k8s_given_name       = var.k8s_sa_name != null ? var.k8s_sa_name : var.name
  output_k8s_name      = var.use_existing_k8s_sa ? local.k8s_given_name : kubernetes_service_account.main[0].metadata[0].name
  output_k8s_namespace = var.use_existing_k8s_sa ? var.namespace : kubernetes_service_account.main[0].metadata[0].namespace
}

# resource "google_service_account" "cluster_service_account" {
  # GCP service account ids must be < 30 chars matching regex ^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$
  # KSA do not have this naming restriction.
  # account_id   = substr(var.name, 0, 30)
  # display_name = substr("GCP SA bound to K8S SA ${local.k8s_given_name}", 0, 100)
  # project      = var.project_id
# }
resource "kubernetes_namespace" "k8s_namespace" {
  metadata {
    name = var.namespace
  }
}

resource "kubernetes_secret_v1" "main" {
  count = var.use_existing_k8s_sa ? 0 : 1
  metadata {
    namespace = var.namespace
    annotations = {
      "kubernetes.io/service-account.name"      = kubernetes_service_account.main[0].metadata[0].name
      "kubernetes.io/service-account.namespace" = kubernetes_service_account.main[0].metadata[0].namespace
    }
    generate_name = "${kubernetes_service_account.main[0].metadata[0].name}-token-"
  }
  type = "kubernetes.io/service-account-token"
  wait_for_service_account_token = true
}

resource "kubernetes_service_account" "main" {
  count = var.use_existing_k8s_sa ? 0 : 1
  metadata {
    name      = var.name
    namespace = var.namespace
    annotations = {
      "iam.gke.io/gcp-service-account" = var.google_service_account_email
    }
  }
}


module "annotate-sa" {
  source  = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
  version = "~> 2.0.2"

  enabled          = var.use_existing_k8s_sa && var.annotate_k8s_sa
  skip_download    = true
  cluster_name     = var.cluster_name
  cluster_location = var.location
  project_id       = var.project_id

  kubectl_create_command  = "kubectl annotate --overwrite sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account=${local.gcp_sa_email}"
  kubectl_destroy_command = "kubectl annotate sa -n ${local.output_k8s_namespace} ${local.k8s_given_name} iam.gke.io/gcp-service-account-"
}

resource "google_service_account_iam_member" "main" {
  service_account_id = local.service_id
  role               = "roles/iam.workloadIdentityUser"
  member             = local.k8s_sa_gcp_derived_name
}

内容的提问来源于stack exchange，提问作者user2439278