如何通过Terraform结合Rancher在K8s集群中创建Pod？

要在你通过Rancher管理的K8s集群中创建Pod，需要结合Kubernetes Terraform Provider（因为rancher2 provider仅负责Rancher层面的资源管理，Pod是K8s原生资源）。以下是具体实现步骤：

1. 扩展Terraform配置，添加Kubernetes Provider #

你有两种方式配置K8s Provider，选其一即可：

方式一：手动导入集群kubeconfig #

从Rancher控制台导出目标集群的kubeconfig文件，然后配置Provider：

terraform {
  required_providers {
    rancher2 = {
      source = "rancher/rancher2"
      version = "1.24.1"
    }
    kubernetes = {
      source = "hashicorp/kubernetes"
      version = "2.23.0" # 选择与集群版本兼容的版本
    }
  }
}

# 保留原有的rancher2 Provider配置
provider "rancher2" {
  api_url   = "https://192.168.1.128/v3"
  token_key = "token-n4fxx:4qcgctvph7qh2sdnn762zpzg889rgw8xpd2nvcnpnr4v4wpb9zljtd"
  insecure = true
}

# 配置Kubernetes Provider
provider "kubernetes" {
  config_path = "./your-cluster-kubeconfig.yaml" # 替换为你的kubeconfig文件路径
  insecure = true # 集群用自签证书时需要添加
}

方式二：通过rancher2 Provider自动获取kubeconfig #

无需手动导出，直接从Rancher API拉取集群的kubeconfig信息：

terraform {
  required_providers {
    rancher2 = {
      source = "rancher/rancher2"
      version = "1.24.1"
    }
    kubernetes = {
      source = "hashicorp/kubernetes"
      version = "2.23.0"
    }
  }
}

provider "rancher2" {
  api_url   = "https://192.168.1.128/v3"
  token_key = "token-n4fxx:4qcgctvph7qh2sdnn762zpzg889rgw8xpd2nvcnpnr4v4wpb9zljtd"
  insecure = true
}

# 读取目标集群的信息
data "rancher2_cluster" "target_cluster" {
  name = "你的集群名称" # 替换为Rancher中显示的集群名称
}

# 自动配置Kubernetes Provider
provider "kubernetes" {
  host                   = data.rancher2_cluster.target_cluster.api_endpoint
  token                  = data.rancher2_cluster.target_cluster.kube_config.0.token
  cluster_ca_certificate = base64decode(data.rancher2_cluster.target_cluster.kube_config.0.ca_certs)
  insecure = true
}

2. 添加Pod资源配置 #

在现有配置中加入kubernetes_pod资源，指定到之前创建的zone-1命名空间：

# 保留原有的namespace资源
resource "rancher2_namespace" "zone-1" {
  name = "zone-1"
  project_id = "c-m-xmhbjzdt:p-sd86v"
  description = "zone-1 namespace"
  resource_quota {
    limit {
      limits_cpu = "100m"
      limits_memory = "100Mi"
      requests_storage = "1Gi"
    }
  }
  container_resource_limit {
    limits_cpu = "20m"
    limits_memory = "20Mi"
    requests_cpu = "1m"
    requests_memory = "1Mi"
  }
}

# 创建示例Pod
resource "kubernetes_pod" "nginx_pod" {
  metadata {
    name      = "nginx-demo"
    namespace = rancher2_namespace.zone-1.name # 关联到已创建的命名空间
    labels = {
      app = "nginx-demo"
    }
  }

  spec {
    container {
      name  = "nginx"
      image = "nginx:alpine"

      # 资源限制需符合namespace的配额规则
      resources {
        limits {
          cpu    = "10m"
          memory = "10Mi"
        }
        requests {
          cpu    = "1m"
          memory = "1Mi"
        }
      }
    }
  }
}

3. 执行Terraform命令 #

完成配置后，依次执行以下命令：

# 初始化Provider
terraform init

# 预览执行计划
terraform plan

# 应用配置创建Pod
terraform apply

注意事项 #

• 确保Kubernetes Provider版本与你的K8s集群版本兼容
• Pod的资源请求/限制不能超过zone-1命名空间设置的配额
• 如果集群使用自签证书，必须在Kubernetes Provider中配置insecure = true或正确导入CA证书

内容的提问来源于stack exchange，提问作者Peter Penzov