使用Terraform在GKE集群部署Nginx Docker镜像失败求助

已完成terraform init和terraform plan操作，GKE集群创建成功，但Nginx的Deployment和Service资源部署失败。错误核心是Terraform的Kubernetes Provider未配置GKE集群的认证信息，无法与新创建的集群建立连接。

原main.tf代码 #

variable "project_id" {
  description = "The ID of the GCP project"
  default = "ben-project"
}

variable "cluster_name" {
  description = "The name of the GKE cluster"
  default = "nginx-cluster"
}

provider "google" {
  credentials = file("ben-project-6a028256d353.json")
  project = var.project_id
  region  = "us-central1"
}

resource "google_container_cluster" "nginx" {
  name = var.cluster_name
  location = "us-central1-a"
  initial_node_count = 1

  node_config {
    machine_type = "n1-standard-1"
  }
}

resource "kubernetes_deployment" "nginx" {
  metadata {
    name = "nginx-deployment"
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "nginx"
      }
    }

    template {
      metadata {
        labels = {
          app = "nginx"
        }
      }

      spec {
        container {
          image = "nginx:latest"
          name  = "nginx"
          port {
            container_port = 80
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "nginx" {
  metadata {
    name = "nginx-service"
  }

  spec {
    selector = {
      app = "nginx"
    }

    port {
      name       = "http"
      port       = 80
      target_port = 80
    }

    type = "LoadBalancer"
  }
}

output "kubernetes_api_endpoint" {
  value = google_container_cluster.nginx.endpoint
}

output "nginx_external_ip" {
    value = kubernetes_service.nginx.status[0].load_balancer[0].ingress[0].ip
}

问题原因 #

1. 缺少Kubernetes Provider配置：原代码仅配置了Google Provider，但未配置Kubernetes Provider的认证参数，导致Terraform无法访问GKE集群的API服务器。
2. Output引用错误：nginx_external_ip中对status的引用错误，status是对象而非列表，无需用[0]索引。

解决方案 #

1. 添加Kubernetes Provider配置 #

通过GKE集群的属性自动获取认证信息，确保Kubernetes Provider能连接到集群：

# 配置Kubernetes Provider，依赖GKE集群的认证信息
provider "kubernetes" {
  host  = "https://${google_container_cluster.nginx.endpoint}"
  token = data.google_client_config.current.access_token
  cluster_ca_certificate = base64decode(google_container_cluster.nginx.master_auth[0].cluster_ca_certificate)
}

# 获取当前GCP客户端的访问令牌
data "google_client_config" "current" {}

2. 修正Output引用 #

将nginx_external_ip的输出修正为正确的对象引用：

output "nginx_external_ip" {
  value = kubernetes_service.nginx.status.load_balancer.ingress[0].ip
}

3. 显式声明资源依赖 #

为确保Kubernetes资源在GKE集群完全就绪后再创建，可在kubernetes_deployment和kubernetes_service中添加depends_on：

resource "kubernetes_deployment" "nginx" {
  # ... 原有代码 ...
  depends_on = [google_container_cluster.nginx]
}

resource "kubernetes_service" "nginx" {
  # ... 原有代码 ...
  depends_on = [google_container_cluster.nginx]
}

修正后的完整main.tf代码 #

variable "project_id" {
  description = "The ID of the GCP project"
  default = "ben-project"
}

variable "cluster_name" {
  description = "The name of the GKE cluster"
  default = "nginx-cluster"
}

provider "google" {
  credentials = file("ben-project-6a028256d353.json")
  project = var.project_id
  region  = "us-central1"
}

# 配置Kubernetes Provider，依赖GKE集群的认证信息
provider "kubernetes" {
  host  = "https://${google_container_cluster.nginx.endpoint}"
  token = data.google_client_config.current.access_token
  cluster_ca_certificate = base64decode(google_container_cluster.nginx.master_auth[0].cluster_ca_certificate)
}

# 获取当前GCP客户端的访问令牌
data "google_client_config" "current" {}

resource "google_container_cluster" "nginx" {
  name = var.cluster_name
  location = "us-central1-a"
  initial_node_count = 1

  node_config {
    machine_type = "n1-standard-1"
  }
}

resource "kubernetes_deployment" "nginx" {
  metadata {
    name = "nginx-deployment"
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "nginx"
      }
    }

    template {
      metadata {
        labels = {
          app = "nginx"
        }
      }

      spec {
        container {
          image = "nginx:latest"
          name  = "nginx"
          port {
            container_port = 80
          }
        }
      }
    }

    depends_on = [google_container_cluster.nginx]
  }
}

resource "kubernetes_service" "nginx" {
  metadata {
    name = "nginx-service"
  }

  spec {
    selector = {
      app = "nginx"
    }

    port {
      name       = "http"
      port       = 80
      target_port = 80
    }

    type = "LoadBalancer"
  }

  depends_on = [google_container_cluster.nginx]
}

output "kubernetes_api_endpoint" {
  value = google_container_cluster.nginx.endpoint
}

output "nginx_external_ip" {
  value = kubernetes_service.nginx.status.load_balancer.ingress[0].ip
}

执行步骤 #

1. 执行terraform init初始化配置（若之前已初始化，可跳过）
2. 执行terraform plan检查配置
3. 执行terraform apply完成部署

内容的提问来源于stack exchange，提问作者user20901644