如何从Terraform嵌套对象中提取所有Secrets生成扁平列表

需要基于tfvars.json中定义的嵌套secrets变量，创建名为secret_list的本地变量，要求它是包含所有secret条目的扁平对象列表。当前代码输出的是带value键的对象，不符合预期。

相关细节 #

1. secrets变量的JSON结构：

{"secrets" : {
        "datacore": {
            "secrets" : [
                {"secret_scope": "datacore", "secret_key": "serviceaccount-databricks-deploy", "secret_value": "dummy"},
                {"secret_scope": "datacore", "secret_key": "serviceaccount-datacore", "secret_value": "dummy"}
            ],
            "acls" : [
                {"secret_scope": "datacore", "principal": "admins", "permission": "MANAGE"},
                {"secret_scope": "datacore", "principal": "Datacore Power Users", "permission": "READ"}
            ]
        },
        "ai" : {
            "secrets" : [
                {"secret_scope": "ai", "secret_key": "serviceaccount-ai", "secret_value": "dummy"},
                {"secret_scope": "ai", "secret_key": "serviceaccount-ai-private-key", "secret_value": "dummy"}
            ],
            "acls" : [
                {"secret_scope": "ai", "principal": "admins", "permission": "MANAGE"},
                {"secret_scope": "ai", "principal": "AI Power Users", "permission": "READ"}
            ]
        }
   }
}

2. secrets变量的Terraform类型定义：

variable "secrets" {
    type = map(object({
            secrets = list(
                object({
                    secret_scope = string,
                    secret_key = string,
                    secret_value =string
                })),
            acls = list(
                object({
                    secret_scope = string,
                    principal = string,
                    permission = string
            }))}))
}

3. 尝试的本地变量代码：

locals {
    secret_list = {
        value = flatten([
            for secrets in var.secrets : [
                for secret_attributes in secrets.secrets : secret_attributes
            ]
        ])
    }
}

4. 当前输出结果：

secret_list              = {
      + value = [
          + {
              + secret_key   = "serviceaccount-databricks-deploy"
              + secret_scope = "datacore"
              + secret_value = "dummy"
            },
          + {
              + secret_key   = "serviceaccount-datacore"
              + secret_scope = "datacore"
              + secret_value = "dummy"
            },
          + {
              + secret_key   = "serviceaccount-ai"
              + secret_scope = "ai"
              + secret_value = "dummy"
            },
          + {
              + secret_key   = "serviceaccount-ai-private-key"
              + secret_scope = "ai"
              + secret_value = "dummy"
            }
       ]
}

5. 期望输出结果：

secret_list =  [
{"secret_scope": "datacore", "secret_key": "serviceaccount-databricks-deploy", "secret_value": "dummy"},
{"secret_scope": "datacore", "secret_key": "serviceaccount-datacore", "secret_value": "dummy"},
{"secret_scope": "ai", "secret_key": "serviceaccount-ai", "secret_value": "dummy"},
{"secret_scope": "ai", "secret_key": "serviceaccount-ai-private-key", "secret_value": "dummy"}
]

解决方案 #

问题出在给secret_list赋值了一个包含value键的对象，而非直接使用flatten的结果。去掉外层对象包装，直接将扁平化后的列表赋值给secret_list即可：

locals {
    secret_list = flatten([
        for secrets in var.secrets : [
            for secret_attributes in secrets.secrets : secret_attributes
        ]
    ])
}

验证 #

修改后，secret_list会直接成为符合预期的扁平对象列表。

内容的提问来源于stack exchange，提问作者Lo0fah