如何在GKE Terraform配置中部署Let's Encrypt ClusterIssuer

你可以直接使用Terraform官方Kubernetes provider提供的kubernetes_manifest资源来部署ClusterIssuer，无需额外调用kubectl命令，操作步骤如下：

步骤1：添加ClusterIssuer资源配置 #

直接在你现有的Terraform配置末尾追加如下代码即可：

resource "kubernetes_manifest" "letsencrypt_prod_clusterissuer" {
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "ClusterIssuer"
    metadata = {
      name = "letsencrypt-prod"
    }
    spec = {
      acme = {
        # 替换为你自己的Let's Encrypt通知邮箱
        email = "example@example.com"
        server = "https://acme-v02.api.letsencrypt.org/directory"
        privateKeySecretRef = {
          name = "letsencrypt-prod"
        }
        solvers = [
          {
            http01 = {
              ingress = {
                class = "nginx"
              }
            }
          }
        ]
      }
    }
  }

  # 强制等待cert-manager部署完成、CRD注册成功后再执行创建
  depends_on = [helm_release.cert]
}

可选灵活配置方案 #

如果你希望保留独立的letsencrypt.yaml配置文件，还可以通过模板读取的方式实现，更便于管理配置：

1. 把你现有的letsencrypt.yaml中邮箱字段修改为占位符：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: ${acme_email}
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

2. 在Terraform配置中追加如下代码：

# 可自定义的Let's Encrypt通知邮箱变量
variable "acme_email" {
  type        = string
  description = "证书过期等事件的通知邮箱"
  default     = "your_real_email@domain.com"
}

resource "kubernetes_manifest" "letsencrypt_prod_clusterissuer" {
  manifest = yamldecode(templatefile("./letsencrypt.yaml", {
    acme_email = var.acme_email
  }))

  depends_on = [helm_release.cert]
}

注意事项 #

• 必须配置depends_on参数，否则可能出现在cert-manager的CRD还未完成注册时就提交ClusterIssuer，导致Terraform报资源类型不存在的错误
• 需确保你使用的Kubernetes provider版本不低于v2.0，该版本才原生支持kubernetes_manifest资源

内容的提问来源于stack exchange，提问作者gharbi.bdr