通过Terraform在AKS部署Helm Release时的认证错误排查

问题根源 #

你碰到的Invalid index错误核心原因有两个：

1. 错误把kube_config当成列表引用：azurerm_kubernetes_cluster数据源的kube_config是单个对象，不是数组集合，根本不需要加.0索引。
2. kube_admin_config大概率未启用：AKS默认不开启管理员访问权限，要是集群没开这个选项，kube_admin_config属性本身就不存在，直接引用自然会报错。

修正后的配置代码 #

1. 数据源配置保持不变（main.tf） #

data "azurerm_kubernetes_cluster" "credentials" {
  name                = var.aks_cluster_name
  resource_group_name = var.aks_cluster_resource_group_name
}

2. 修正Helm和Kubernetes Provider配置（versions.tf） #

用普通用户的kube_config（直接访问对象属性，去掉多余的.0）：

terraform {
  required_providers {
    datadog = {
      source = "DataDog/datadog"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0" # 建议指定兼容版本，适配Terraform 1.1.7
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.0"
    }
  }
  backend "azurerm" {
  }
}

provider "azurerm" {
  features {}
}

provider "helm" {
  debug = true
  kubernetes {
    host                   = data.azurerm_kubernetes_cluster.credentials.kube_config.host
    username               = data.azurerm_kubernetes_cluster.credentials.kube_config.username
    password               = data.azurerm_kubernetes_cluster.credentials.kube_config.password
    client_certificate     = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_config.client_certificate)
    client_key             = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_config.client_key)
    cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_config.cluster_ca_certificate)
  }
}

provider "kubernetes" {
  host                   = data.azurerm_kubernetes_cluster.credentials.kube_config.host
  username               = data.azurerm_kubernetes_cluster.credentials.kube_config.username
  password               = data.azurerm_kubernetes_cluster.credentials.kube_config.password
  client_certificate     = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_config.client_certificate)
  client_key             = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_config.client_key)
  cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_config.cluster_ca_certificate)
}

要是必须用管理员账户（kube_admin_config） #

如果你的AKS集群确实开了管理员权限，先确认集群配置里enable_rbac = true且开启了admin访问，再把provider改成下面这样：

provider "helm" {
  debug = true
  kubernetes {
    host                   = data.azurerm_kubernetes_cluster.credentials.kube_admin_config.host
    username               = data.azurerm_kubernetes_cluster.credentials.kube_admin_config.username
    password               = data.azurerm_kubernetes_cluster.credentials.kube_admin_config.password
    cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_admin_config.cluster_ca_certificate)
  }
}

provider "kubernetes" {
  host                   = data.azurerm_kubernetes_cluster.credentials.kube_admin_config.host
  username               = data.azurerm_kubernetes_cluster.credentials.kube_admin_config.username
  password               = data.azurerm_kubernetes_cluster.credentials.kube_admin_config.password
  cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.credentials.kube_admin_config.cluster_ca_certificate)
}

注意：kube_admin_config没有client_certificate和client_key这两个属性，别瞎配置。

额外小技巧 #

• 给每个provider指定兼容的版本号，避免版本不兼容搞出隐性问题，Terraform 1.1.7搭配azurerm 3.x、helm 2.x、kubernetes 2.x比较稳。
• 要是还碰认证问题，试试直接用kube_config_raw属性，省得手动拆分kubeconfig的各个字段：

provider "kubernetes" {
  config_raw = data.azurerm_kubernetes_cluster.credentials.kube_config_raw
}

provider "helm" {
  kubernetes {
    config_raw = data.azurerm_kubernetes_cluster.credentials.kube_config_raw
  }
}

内容的提问来源于stack exchange，提问作者kubectlgetpods