Terraform EKS标记 [英] Terraform EKS tagging

问题描述

我遇到了这个Terraform EKS标记问题，并且在创建新集群时似乎找不到可行的解决方案来标记所有VPC子网.

I am having this issue of Terraform EKS tagging and don't seem to find workable solution to tag all the VPC subnets when a new cluster is created.

提供一些背景信息:我们有一个AWS VPC，在其中将几个EKS集群部署到子网中.我们不创建VPC，或者子网是EKS群集创建的一部分.因此，创建集群的terraform代码无法标记现有的子网和VPC.尽管EKS会添加必需的标签，但是下次我们在VPC上运行terraform apply时，它们会被自动删除.

To provide some context: We have one AWS VPC where we deployment several EKS cluster into the subnets. We do not create VPC or subnets are part of the EKS cluster creation. Therefore, the terraform code creating a cluster doesn't get to tag existing subnets and VPC. Although EKS will add the required tags, they are automatically removed next time we run terraform apply on the VPC.

我的解决方法是在VPC中提供一个terraform.tfvars文件，如下所示:

My attempt to workaround is to provide a terraform.tfvars file within the VPC to as follows:

eks_tags = 
 [
 "kubernetes.io/cluster/${var.cluster-1}", "shared", 
 "kubernetes.io/cluster/${var.cluster-2}", "shared",
 "kubernetes.io/cluster/${var.cluster-2}", "shared",
]    

然后在VPC和子网资源中，执行类似

Then within the VPC and subnets resources, we do something like

    resource "aws_vpc" "demo" {
      cidr_block = "10.0.0.0/16"

      tags = "${
        map(
         ${var.eks_tags}
        )
     }"
    }

但是，以上方法似乎无效.我已经尝试了 https://www.terraform的各种Terraform 0.11函数.io/docs/configuration-0-11/interpolation.html ，但没有帮助.

However, the above does not seem to work. I have tried various Terraform 0.11 functions from https://www.terraform.io/docs/configuration-0-11/interpolation.html but not of them help.

有人能解决此问题吗?

我们总是为每个EKS群集创建新的VPC和子网的想法是错误的.显然，这一定是使用Terraform标记现有VPC和子网资源的方法吗?

The idea that we always create new VPC and subnet for every EKS cluster is wrong. Obviously, the has to be a way to tag existing VPC and subnet resources using Terraform?

推荐答案

您现在可以使用aws提供程序的 ignore_tags 属性，以便使用 aws_ec2_tag 资源制作的标签可以使用下次应用VPC模块时不会被删除.

You can now use the aws provider ignore_tags attribute so that the tags made with the aws_ec2_tag resource do not get removed next time the VPC module is applied.

例如，提供者变为:

provider "aws" {
  profile = "terraform"
  region  = "us-west-1"
  
  // This is necessary so that tags required for eks can be applied to the vpc without changes to the vpc wiping them out.
  // https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/resource-tagging
  ignore_tags {
    key_prefixes = ["kubernetes.io/"]
  }
}

添加后，您可以像在EKS模块中一样利用 aws_ec2_tag 资源，而不必担心下次应用VPC模块时会删除该标签.

Add you can then leverage the aws_ec2_tag resource like so in your EKS module without worrying about the tag getting removed next time the VPC module is applied.

/*
  Start of resource tagging logic to update the provided vpc and its subnets with the necessary tags for eks to work
  The toset() function is actually multiplexing the resource block, one for every item in the set. It is what allows 
  for setting a tag on each of the subnets in the vpc.
*/
resource "aws_ec2_tag" "vpc_tag" {
  resource_id = data.terraform_remote_state.vpc.outputs.vpc_id
  key         = "kubernetes.io/cluster/${var.cluster_name}"
  value       = "shared"
}

resource "aws_ec2_tag" "private_subnet_tag" {
  for_each    = toset(data.terraform_remote_state.vpc.outputs.private_subnets)
  resource_id = each.value
  key         = "kubernetes.io/role/elb"
  value       = "1"
}

resource "aws_ec2_tag" "private_subnet_cluster_tag" {
  for_each    = toset(data.terraform_remote_state.vpc.outputs.private_subnets)
  resource_id = each.value
  key         = "kubernetes.io/cluster/${var.cluster_name}"
  value       = "shared"
}

resource "aws_ec2_tag" "public_subnet_tag" {
  for_each    = toset(data.terraform_remote_state.vpc.outputs.public_subnets)
  resource_id = each.value
  key         = "kubernetes.io/role/elb"
  value       = "1"
}

resource "aws_ec2_tag" "public_subnet_cluster_tag" {
  for_each    = toset(data.terraform_remote_state.vpc.outputs.public_subnets)
  resource_id = each.value
  key         = "kubernetes.io/cluster/${var.cluster_name}"
  value       = "shared"
}

这篇关于Terraform EKS标记的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！