使用Terraform在AWS EKS部署Kubernetes Secret失败求助

提交的配置代码 #

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.34"
    }
    kubernetes = {
      source = "hashicorp/kubernetes"
      version = "2.15.0"
    }
  }
}


data "aws_eks_cluster" "this" {
  name = "shared_eks01"
}

data "aws_eks_cluster_auth" "this" {
  name = "shared_eks01"
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority.0.data)
  token                  = data.aws_eks_cluster_auth.this.token
}

provider "aws" {
  region = "us-west-2"
}

resource "kubernetes_secret" "spacelift" {
  metadata {
    name      = "spacelift123"
    namespace = "spacelift"
  }
  data = {
    "token"              = "123"
  }
}

遇到的错误 #

连接EKS API端点时被拒绝 #

kubernetes_secret.spacelift: Creating...
╷
│ Error: Post "https://6FC8A63F36709AA...........gr7.us-west-2.eks.amazonaws.com/api/v1/namespaces/spacelift/secrets": dial tcp 127.0.0.1:443: connectex: No connection could be made because the target machine actively refused it.
│
│   with kubernetes_secret.spacelift,
│   on main.tf line 63, in resource "kubernetes_secret" "spacelift":
│   63: resource "kubernetes_secret" "spacelift" {

添加load_config_file参数报错 #

An argument named "load_config_file" is not expected here.

问题原因与修复方案 #

1. Provider定义顺序错误 #

当前配置中provider "aws"定义在Kubernetes provider和data资源之后，导致Terraform初始化时，data "aws_eks_cluster"和data "aws_eks_cluster_auth"无法正确获取EKS集群信息（因为AWS Provider还未完成初始化）。Kubernetes Provider因缺失有效配置，会 fallback 加载本地kubeconfig，而本地kubeconfig可能指向127.0.0.1的本地集群（如minikube/kind），从而出现连接被拒的错误。

修复：将provider "aws"移至所有data资源和Kubernetes Provider之前：

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.34"
    }
    kubernetes = {
      source = "hashicorp/kubernetes"
      version = "2.15.0"
    }
  }
}

# 先定义AWS Provider
provider "aws" {
  region = "us-west-2"
}

# 再获取EKS集群数据
data "aws_eks_cluster" "this" {
  name = "shared_eks01"
}

data "aws_eks_cluster_auth" "this" {
  name = "shared_eks01"
}

# 最后定义Kubernetes Provider
provider "kubernetes" {
  host                   = data.aws_eks_cluster.this.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority.0.data)
  token                  = data.aws_eks_cluster_auth.this.token
}

resource "kubernetes_secret" "spacelift" {
  metadata {
    name      = "spacelift123"
    namespace = "spacelift"
  }
  data = {
    "token"              = "123"
  }
}

2. load_config_file参数已被移除 #

Kubernetes Provider v2.x版本已移除load_config_file参数，当你显式配置了host、cluster_ca_certificate、token这三个核心参数时，Provider会自动忽略本地kubeconfig，无需额外配置该参数。

3. 额外验证步骤 #

• 执行terraform refresh确认data.aws_eks_cluster.this.endpoint和data.aws_eks_cluster_auth.this.token能正确输出EKS集群的真实端点和有效token。
• 检查本地是否设置了KUBECONFIG环境变量，若有可临时取消，避免干扰Provider配置。

内容的提问来源于stack exchange，提问作者Arun