Nsryjdtyk

I'm trying to make a simple test to build a simple nginx on kubernetes from terraform.
This is the first time working terraform.

This is the basic terraform file:

provider "kubernetes" {

  host = "https://xxx.xxx.xxx.xxx:8443"



  client_certificate     = "${file("~/.kube/master.server.crt")}"

  client_key             = "${file("~/.kube/master.server.key")}"

  cluster_ca_certificate = "${file("~/.kube/ca.crt")}"



  username = "xxxxxx"

  password = "xxxxxx"



}



resource "kubernetes_service" "nginx" {

  metadata {

    name = "nginx-example"

  }

  spec {

    selector {

      App = "${kubernetes_pod.nginx.metadata.0.labels.App}"

    }

    port {

      port = 80

      target_port = 80

    }



    type = "LoadBalancer"

  }

}



resource "kubernetes_pod" "nginx" {

  metadata {

    name = "nginx-example"

    labels {

      App = "nginx"

    }

  }



  spec {

    container {

      image = "nginx:1.7.8"

      name  = "example"



      port {

        container_port = 80

      }

    }

  }

}

I'm getting the following error after running the terraform apply.

Error: Error applying plan:

1 error(s) occurred:

• kubernetes_pod.nginx: 1 error(s) occurred:




• kubernetes_pod.nginx: the server has asked for the client to provide credentials (post pods)

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with any
resources that successfully completed. Please address the error above
and apply again to incrementally change your infrastructure.

I have admin permissions on kubernetes and everything is working correctly.
But for some reason I'm getting that error.

What I'm doing wrong?

Thanks

Regarding @matthew-l-daniel question

When I'm only using the username/password I get this error:

Error: Error applying plan:

1 error(s) occurred:

• kubernetes_pod.nginx: 1 error(s) occurred:




• kubernetes_pod.nginx: Post https://xxx.xxx.xxx.xxx:8443/api/v1/namespaces/default/pods:
  x509: certificate signed by unknown authority

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with any
resources that successfully completed. Please address the error above
and apply again to incrementally change your infrastructure.

I tried using the server name or the server ip and got the same error everytime.

When using the certs I got the error from the original post, regarding the "credentials"

I forgot to mention that this is an openshift installation. I don't believe it will have any impact in the end, but I thought I should mention it.

The solution was rather simple, I was using the master crt and key from openshift on terraform.
Then I tested it using the admin crt and key from openshift and it worked.

Aside from the official kubernetes provider documentation suggesting only certificate or basic (user/pass) should be required, this sounds like an OpenShift issue. Have you been able to obtain any logs from the OpenShift cluster?

Some searching links the message you are seeing to some instability bugs within Kubernetes wherein the kubelet does not properly register after a reboot. I would manually confirm the node shows as Ready in OpenShift before you attempt a deployment, as until this occurs Terraform will not be able to interact with it.

If in fact the node is not Ready, Terraform is just surfacing the underlying error passed back from OpenShift.

Separately, the error you are seeing when trying to authenticate using purely certificate parameters is indicative of a misconfiguration. A similar question was raised on the Kubernetes GitHub, and the suggestion there was to investigate the Certificate Authority loaded on to the cluster.