Terraform安装Helm Chart遇StorageClass annotations未知字段如何强制执行？

问题场景 #

现有用于创建StorageClass的Helm Chart模板如下：

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-path
{{- if .Values.storageClass.defaultClass }}
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
{{- end }}
provisioner: rancher.io/local-path
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Delete

对应的values.yaml配置：

storageClass:
  defaultClass: true

使用helm install命令可正常部署该Chart，但通过Terraform的helm_release资源部署时：

resource "helm_release" "storageClassHELM" {
  name       = "storageClassHELM"
  repository = "http://privaterepo:8080"
  chart      = "storageClassHELM"
  version = "0.1.0"

  values = [
    file("${path.module}/values/storageClassHELM.yaml")
  ]
}

执行terraform apply时出现以下错误：

module.config.helm_release.storageClassHelm: Creating...
╷
│ Error: unable to build kubernetes objects from release manifest: error validating "": error validating data: ValidationError(StorageClass): unknown field "annotations" in io.k8s.api.storage.v1.StorageClass
│ 
│   with module.config.helm_release.storageClassHELM,
│   on config/local-path-provisioner.tf line 1, in resource "helm_release" "storageClassHELM":
│    1: resource "helm_release" "storageClassHELM" {

解决办法 #

在Terraform的helm_release资源中添加disable_openapi_validation = true参数，关闭Helm的OpenAPI验证功能，绕过字段校验完成安装。修改后的配置如下：

resource "helm_release" "storageClassHELM" {
  name       = "storageClassHELM"
  repository = "http://privaterepo:8080"
  chart      = "storageClassHELM"
  version    = "0.1.0"

  values = [
    file("${path.module}/values/storageClassHELM.yaml")
  ]

  # 禁用OpenAPI验证，绕过字段校验报错
  disable_openapi_validation = true
}

补充说明 #

该报错的原因是Terraform的Helm provider默认启用了严格的OpenAPI验证，而helm install命令默认未开启该验证。实际上annotations是metadata层级的合法字段，并非StorageClass的根字段，验证逻辑出现误判，通过禁用OpenAPI验证即可解决。

内容的提问来源于stack exchange，提问作者Flissek