azure - 在 Terraform 中部署 AKS 时 "service_principal"的含义

Question

我正在使用 Terraform 并使用“service_principal”部署 AKS。包含该信息的一些代码如下。

resource "azurerm_kubernetes_cluster" "aks" {
  name                                = "${var.cluster_name}"
  location                            = var.location
  resource_group_name                 = data.azurerm_resource_group.aks-rg.name
  node_resource_group                 = "${var.system_rg}-node"
  dns_prefix                          = "${var.cluster_name}"
  kubernetes_version                  = var.aks_version
  private_cluster_enabled             = var.private_cluster_enabled
  private_cluster_public_fqdn_enabled = var.private_cluster_public_fqdn_enabled
  private_dns_zone_id                 = var.private_dns_zone_id
  sku_tier                            = var.sku_tier

  default_node_pool {
    name                         = "syspool01"
    vm_size                      = var.agents_size
    os_disk_size_gb              = var.os_disk_size_gb
    node_count                   = var.agents_count
    vnet_subnet_id               = data.azurerm_subnet.subnet.id
    zones                        = [1, 2, 3]
    kubelet_disk_type            = "OS"
    os_sku                       = "Ubuntu"
    os_disk_type                 = "Managed"
    ultra_ssd_enabled            = "false"
    max_pods                     = var.max_pods
    only_critical_addons_enabled = var.only_critical_addons_enabled
  }

  service_principal {
    client_id     = var.client_id
    client_secret = var.client_secret
  }

  linux_profile {
    admin_username = var.admin_username

    ssh_key {
      key_data = replace(coalesce("${var.ssh_public_key}", tls_private_key.ssh[0].public_key_openssh), "\n", "")
    }
  }

  network_profile {
    network_plugin     = "azure"
    network_policy     = "azure"
    load_balancer_sku  = "standard"           # standard
    outbound_type      = "userDefinedRouting" # loadBalancer, userDefinedRouting, managedNATGateway, userAssignedNATGateway
    service_cidr       = var.service_cidr
    dns_service_ip     = var.dns_service_ip

  }

  tags = {
    Environment = "${var.tag}"
  }

}

1. 当我更改“service_principal”中的“client_secret”时，似乎整个 Pod 都被一一删除并重新创建。

2. 如果我更改“service_principal”中的“client_secret”，并添加可以忽略它的代码，那么使用 AKS 时会遇到问题吗？

  lifecycle {
    ignore_changes = [
      service_principal,
    ]
  }

此外，部署 AKS 时是否必须使用“service_principal”？

请给我一些建议。

Answer 1

If I change the "client_secret" in "service_principal", and put a code that can ignore it, will I have a problem with using AKS?

您可以使用 Terraform 生命周期来防止删除 AKS Pod。您可以在 azurerm_kubernetes_cluster 资源 block 中将 prevent_destroy 属性设置为 true，以防止其被删除。

Terraform 代码。

provider "azurerm" {
  features {}
}

data "azurerm_resource_group" "Mindtree_ResourceGroup" {
  name = "Mindtree_ResourceGroup"
}

resource "azurerm_kubernetes_cluster" "akscluster" {
  name                = "sampleaks1"
  location            = azurerm_resource_group.Mindtree_ResourceGroup.location
  resource_group_name = azurerm_resource_group.Mindtree_ResourceGroup.name
  dns_prefix          = "exampleaks1"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }
  
  service_principal {
    client_id     = deb40947-xxxx-xxx-a626-b3a4c3c7a13f
    client_secret = xxxxxx.NvDo.wQyDb0kqeZMVJcsc
  }
  lifecycle  {
    prevent_destroy = true
    }
    tags = {
    Environment = "Production"
  }
}

Terraform 应用:

当我更改 azurerm_kubernetes_cluster block 中的应用 key 值时，它仅修改指定的值，而不会删除任何现有资源。

引用:Stack Link