如何用Pulumi和TypeScript创建含嵌套数据的K8s Secret？

问题根源很明确：Kubernetes Secret的data或stringData字段只接受字符串类型的值，你直接传入了对象数组，自然会触发类型不匹配的错误。要把嵌套的remote_write配置存入Secret，需要先把结构序列化为JSON字符串，再存入Secret。

直接使用stringData（推荐） #

stringData是K8s和Pulumi都支持的字段，会自动帮你完成base64编码，不用手动处理，代码更简洁：

import * as k8s from "@pulumi/kubernetes";

// 定义你的remote_write嵌套配置
const remoteWriteConfig = [
  {
    url: "https://your-gateway.example.com/api/v1/write",
    basic_auth: {
      username: "monitor-user",
      password: "monitor-pass"
    }
  }
];

// 创建Secret
const prometheusRemoteWriteSecret = new k8s.core.v1.Secret("prometheus-remote-write", {
  metadata: {
    name: "prometheus-remote-write",
    namespace: "monitoring" // 替换成你的命名空间
  },
  stringData: {
    // 将配置序列化为JSON字符串存入
    "remote_write_config.json": JSON.stringify(remoteWriteConfig)
  }
});

手动使用data字段（需自行base64编码） #

如果你一定要用data字段，需要先把JSON字符串转成base64编码：

import * as k8s from "@pulumi/kubernetes";

const remoteWriteConfig = [
  {
    url: "https://your-gateway.example.com/api/v1/write",
    basic_auth: {
      username: "monitor-user",
      password: "monitor-pass"
    }
  }
];

const prometheusRemoteWriteSecret = new k8s.core.v1.Secret("prometheus-remote-write", {
  metadata: {
    name: "prometheus-remote-write",
    namespace: "monitoring"
  },
  data: {
    "remote_write_config.json": Buffer.from(JSON.stringify(remoteWriteConfig)).toString("base64")
  }
});

处理敏感配置（从Pulumi Config读取密钥） #

如果你的密码等敏感数据存在Pulumi配置里（用pulumi config set --secret设置），需要先解析Secret类型的值，再序列化：

import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

const config = new pulumi.Config();
const remoteWriteUrl = config.require("remoteWriteUrl");
const remoteWriteUser = config.require("remoteWriteUsername");
const remoteWritePass = config.requireSecret("remoteWritePassword");

// 用pulumi.all处理异步的Secret值
const prometheusRemoteWriteSecret = pulumi.all([remoteWritePass]).apply(([password]) => {
  const resolvedConfig = [
    {
      url: remoteWriteUrl,
      basic_auth: {
        username: remoteWriteUser,
        password: password
      }
    }
  ];

  return new k8s.core.v1.Secret("prometheus-remote-write", {
    metadata: {
      name: "prometheus-remote-write",
      namespace: "monitoring"
    },
    stringData: {
      "remote_write_config.json": JSON.stringify(resolvedConfig)
    }
  });
});

内容的提问来源于stack exchange，提问作者robolott