Run kubernetes build from terraform

Question

I'm trying to make a simple test to build a simple nginx on kubernetes from terraform. This is the first time working terraform.

This is the basic terraform file:

provider "kubernetes" {
  host = "https://xxx.xxx.xxx.xxx:8443"

  client_certificate     = "${file("~/.kube/master.server.crt")}"
  client_key             = "${file("~/.kube/master.server.key")}"
  cluster_ca_certificate = "${file("~/.kube/ca.crt")}"

  username = "xxxxxx"
  password = "xxxxxx"

}

resource "kubernetes_service" "nginx" {
  metadata {
    name = "nginx-example"
  }
  spec {
    selector {
      App = "${kubernetes_pod.nginx.metadata.0.labels.App}"
    }
    port {
      port = 80
      target_port = 80
    }

    type = "LoadBalancer"
  }
}

resource "kubernetes_pod" "nginx" {
  metadata {
    name = "nginx-example"
    labels {
      App = "nginx"
    }
  }

  spec {
    container {
      image = "nginx:1.7.8"
      name  = "example"

      port {
        container_port = 80
      }
    }
  }
}

I'm getting the following error after running the terraform apply.

Error: Error applying plan:

1 error(s) occurred:

kubernetes_pod.nginx: 1 error(s) occurred:

kubernetes_pod.nginx: the server has asked for the client to provide credentials (post pods)

Terraform does not automatically rollback in the face of errors. Instead, your Terraform state file has been partially updated with any resources that successfully completed. Please address the error above and apply again to incrementally change your infrastructure.

I have admin permissions on kubernetes and everything is working correctly. But for some reason I'm getting that error.

What I'm doing wrong?

Thanks

Regarding @matthew-l-daniel question

When I'm only using the username/password I get this error:

Error: Error applying plan:

1 error(s) occurred:

kubernetes_pod.nginx: 1 error(s) occurred:

kubernetes_pod.nginx: Post https://xxx.xxx.xxx.xxx:8443/api/v1/namespaces/default/pods: x509: certificate signed by unknown authority

Terraform does not automatically rollback in the face of errors. Instead, your Terraform state file has been partially updated with any resources that successfully completed. Please address the error above and apply again to incrementally change your infrastructure.

I tried using the server name or the server ip and got the same error everytime.

When using the certs I got the error from the original post, regarding the "credentials"

I forgot to mention that this is an openshift installation. I don't believe it will have any impact in the end, but I thought I should mention it.

It's very, very weird to have both TLS auth and HTTP Basic "username" and "password"; do you have any such authentication configured for your cluster, that you would expect username+password to do something? — mdaniel
Why not use helm-charts to deploy nginx? Seems much easier than terraform? — Gavin

radicaled radicaled · Accepted Answer · 2018-12-13T14:33:47

The solution was rather simple, I was using the master crt and key from openshift on terraform. Then I tested it using the admin crt and key from openshift and it worked.

Run kubernetes build from terraform

2 Answers