Terraform结合Flux配置K8s Secret及GitLab部署密钥咨询

Hey there! Let’s break down your current setup and help you refine it to get Flux up and running smoothly with GitLab. First off, your overall approach is correct—using Helm to deploy Flux, generating an SSH key pair for Git authentication, and storing the private key in a Kubernetes Secret while adding the public key to GitLab is the standard, secure way to set up Flux with a Git repository.

Let’s tackle each of your requirements and fill in the gaps:

1. Fetch SSH Host Key from a URL for ssh.known_hosts #

To pull the SSH host key from a URL and format it correctly for Flux, you’ll use Terraform’s http data source. This ensures you’re using the latest valid host key for your Git provider (e.g., GitLab) and avoids manual copying errors.

First, add the http data source and a local value to format the entry properly (Flux expects hostname ssh-rsa public_key format):

# Fetch the SSH host key from your Git provider's public URL
data "http" "gitlab_ssh_host_key" {
  url = "https://gitlab.com/ssh_host_rsa_key.pub" # Replace with your Git host's public key URL
}

# Format the known_hosts entry to match Flux's requirements
locals {
  git_hostname       = "gitlab.com" # Replace with your Git repository's hostname
  flux_known_hosts   = "${local.git_hostname} ${data.http.gitlab_ssh_host_key.body}"
}

Then update your helm_release.flux resource to use this formatted value:

resource "helm_release" "flux" {
  name       = "flux"
  namespace  = "flux"
  repository = data.helm_repository.fluxcd.metadata[0].name
  chart      = "flux"
  version    = "1.0.0" # Pin to a specific stable version (replace with latest Flux chart version)

  set {
    name  = "git.url"
    value = "git@gitlab.com:your-username/your-repo.git" # Replace with your Git SSH URL
  }

  set {
    name  = "git.secretName"
    value = "flux-git-deploy"
  }

  set {
    name  = "syncGarbageCollection.enabled"
    value = true
  }

  set_string {
    name  = "ssh.known_hosts"
    value = local.flux_known_hosts # Use the formatted known_hosts entry
  }
}

2. Complete the SSH Key Pair & GitLab Deploy Key Setup #

Your current code is missing the tls_private_key resource that generates the actual SSH key pair. Add this to your configuration—it will create a secure RSA key that Flux uses to authenticate with GitLab:

# Generate a secure RSA key pair for Flux Git authentication
resource "tls_private_key" "flux" {
  algorithm = "RSA"
  rsa_bits  = 4096 # 4096 bits is recommended for enhanced security
}

resource "kubernetes_secret" "flux-git-deploy" {
  metadata {
    name      = "flux-git-deploy"
    namespace = "flux"
  }

  type = "Opaque"

  data = {
    identity = tls_private_key.flux.private_key_pem # Use the generated private key
  }
}

resource "gitlab_deploy_key" "flux_deploy_key" {
  title    = "Flux CD Deploy Key" # Give it a descriptive title
  project  = "your-project-id" # Replace with your GitLab project ID
  key      = tls_private_key.flux.public_key_openssh # Use the generated public key
  can_push = true # Set to true if Flux needs to push changes (e.g., ImageUpdateAutomation)
}

Key Best Practices to Add #

• Create the Flux Namespace First: Ensure the flux namespace exists before deploying the Helm chart or creating secrets. Add this resource to avoid errors:

  resource "kubernetes_namespace" "flux" {
    metadata {
      name = "flux"
    }
  }
  

  (Helm can create the namespace automatically, but explicitly defining it gives you more control.)

• Pin Helm Chart Versions: Always specify a version in your helm_release resource to prevent unexpected updates to newer (potentially breaking) versions of the Flux chart.

• Sensitive Data Handling: Terraform automatically marks the private key as sensitive, so avoid adding it to outputs or logs. If you need to debug, use terraform state show tls_private_key.flux cautiously.

Final Check #

Your core implementation direction is solid—you’re following Flux’s recommended Git authentication flow. With the additions above, your configuration will:

1. Generate a secure SSH key pair
2. Store the private key in a Kubernetes Secret for Flux
3. Register the public key as a deploy key in GitLab
4. Automatically fetch and format the Git host key for secure SSH connections

内容的提问来源于stack exchange，提问作者Jozef Vrana