使用Terraform为AWS上Kubernetes配置Pod定时重启遇RBAC错误求助

1 报错直接修复方案 #

你遇到的报错是因为RoleBinding中ServiceAccount类型的subject的api_group配置错误，ServiceAccount属于Kubernetes核心API组，对应apiGroup应为空字符串，将kubernetes_role_binding资源中subject块的api_group = "rbac.authorization.k8s.io"修改为api_group = ""即可解决当前报错。

2 其他需调整的配置问题 #

• CronJob内的kubectl命令缺少目标参数：原配置的命令未指定要重启的Deployment范围，执行时会报错，需补充命名空间、目标Deployment名称参数
• 命名空间未统一：Role、RoleBinding、ServiceAccount、CronJob均为命名空间级资源，需在所有资源的metadata块明确指定命名空间，避免权限不生效
• 减少外部依赖：建议直接通过Terraform创建ServiceAccount，无需依赖外部预创建的ServiceAccount资源

3 完整可运行配置示例 #

# 变量定义
variable "target_namespace" {
  type        = string
  default     = "default"
  description = "目标Deployment所在的命名空间"
}

variable "restart_schedule" {
  type        = string
  default     = "0 8 * * 1" # 每周一早上8点，按需调整Cron表达式
  description = "自动重启执行周期"
}

variable "target_deployment" {
  type        = string
  default     = "" # 留空则重启命名空间下所有Deployment
  description = "指定要重启的Deployment名称"
}

# 创建专用ServiceAccount
resource "kubernetes_service_account" "deployment_restart" {
  metadata {
    name      = "deployment-restart-sa"
    namespace = var.target_namespace
  }
}

# 创建Role定义操作权限
resource "kubernetes_role" "deployment_restart" {
  metadata {
    name      = "deployment-restart-role"
    namespace = var.target_namespace
  }

  rule {
    api_groups = ["apps"]
    resources  = ["deployments", "deployments/rollout"]
    verbs      = ["get", "patch"]
  }
}

# 绑定ServiceAccount和Role
resource "kubernetes_role_binding" "deployment_restart" {
  metadata {
    name      = "deployment-restart-rb"
    namespace = var.target_namespace
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = kubernetes_role.deployment_restart.metadata[0].name
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.deployment_restart.metadata[0].name
    api_group = ""
    namespace = var.target_namespace
  }
}

# 创建自动重启CronJob
resource "kubernetes_cron_job" "deployment_restart" {
  metadata {
    name      = "deployment-restart-cron"
    namespace = var.target_namespace
  }
  spec {
    concurrency_policy            = "Forbid"
    schedule                      = var.restart_schedule
    starting_deadline_seconds     = 10
    successful_jobs_history_limit = 3
    failed_jobs_history_limit     = 3
    job_template {
      spec {
        backoff_limit              = 2
        active_deadline_seconds    = 600
        template {
          spec {
            service_account_name = kubernetes_service_account.deployment_restart.metadata[0].name
            restart_policy       = "OnFailure"
            container {
              name    = "kubectl"
              image   = "bitnami/kubectl:latest"
              command = var.target_deployment != "" ? ["kubectl", "rollout", "restart", "deployment/${var.target_deployment}", "-n", var.target_namespace] : ["kubectl", "rollout", "restart", "deployment", "-n", var.target_namespace]
            }
          }
        }
      }
    }
  }
}

如果需要重启集群内所有命名空间的Deployment，将Role替换为ClusterRole、RoleBinding替换为ClusterRoleBinding即可。

内容的提问来源于stack exchange，提问作者theahura