kubernetes_cluster_role aggregation_rule with multiple matchLabels

[craigmunro]

Terraform version, Kubernetes provider version and Kubernetes version

Terraform version: v0.14.10
Kubernetes Provider version: v2.1.0
Kubernetes version: v1.17.17-gke.4900

Terraform configuration

resource "kubernetes_cluster_role" "example" {

  metadata {
    name   = "example"
  }

  aggregation_rule {
    cluster_role_selectors {
      match_labels = {
        "rbac.authorization.k8s.io/aggregate-to-view" = "true"
      }
      match_labels = {
        "example.io/aggregregate-to-app" = "true"
      }
    }
  }
}

Question

The following is a valid cluster role and works as expected aggregating rules from roles that match either of the selectors:

aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      example.io/aggregregate-to-app: "true"
  - matchLabels:
      rbac.authorization.k8s.io/aggregate-to-view: "true"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole

How can I express that in terraform? The code above results in:

Error: Attribute redefined

On .terraform/modules/default.default/example.tf line 63: The argument
"match_labels" was already set at
.terraform/modules/default.default/example.tf:60,7-19. Each argument may be set
only once.

I can do the following:

  aggregation_rule {
    cluster_role_selectors {
      match_labels = {
        "rbac.authorization.k8s.io/aggregate-to-view" = "true"
        "example.io/aggregregate-to-app" = "true"
      }
    }

but that results in:

aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      example.io/aggregregate-to-app: "true"
      rbac.authorization.k8s.io/aggregate-to-view: "true"

which selects roles which match both labels not either.

Are multiple matchLabels supported? If so, how? If not, consider this a feature request :-)

[fmulero]

The following code should work:

resource "kubernetes_cluster_role" "example" {

  metadata {
    name   = "example"
  }

  aggregation_rule {
    cluster_role_selectors {
      match_labels = {
        "rbac.authorization.k8s.io/aggregate-to-view" = "true"
      }
    }
    cluster_role_selectors {
      match_labels = {
        "example.io/aggregregate-to-app" = "true"
      }
    }
  }
}

BUT the second cluster_role selector is ignored.

I have a similar example and this is the output of the plan (v1.0.0)

 # module.kubernetes.module.config.kubernetes_cluster_role.engineer will be updated in-place
  ~ resource "kubernetes_cluster_role" "engineer" {
        id = "engineer"

      ~ aggregation_rule {
          ~ cluster_role_selectors {
              ~ match_labels = {
                  - "rbac.authorization.k8s.io/aggregate-to-view"    = "true" -> null
                  + "rbac.travisperkins.co.uk/aggregate-to-engineer" = "true"
                }
            }
          + cluster_role_selectors {
              + match_labels = {
                  + "rbac.authorization.k8s.io/aggregate-to-view" = "true"
                }
            }
        }


        # (62 unchanged blocks hidden)
    }

BUT the role created by terraform has only one match_label

[tgip-work]

Same for me.
Solved it via kubernetes_manifest

Sample:

resource "kubernetes_manifest" "cluster_view2" {
  manifest = {
    "apiVersion" = "rbac.authorization.k8s.io/v1"
    "kind"       = "ClusterRole"
    "metadata" = {
      "name"      = "cluster-view"
      "annotations" = {
        "description" = "Aggregated role with permissions from default clusterrole 'view' and new clusterroles with aggregate-to-cluster-view"
      }
    }
    "aggregationRule" = {
      "clusterRoleSelectors" = [
        {
          "matchLabels" = {
            "rbac.authorization.k8s.io/aggregate-to-view" = "true"
          }
        },
        {
          "matchLabels" = {
            "rbac.authorization.k8s.io/aggregate-to-cluster-view" = "true"
          }
        }
      ]
    }
  }
}

[github-actions]

Marking this issue as stale due to inactivity. If this issue receives no comments in the next 30 days it will automatically be closed. If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. This helps our maintainers find and focus on the active issues. Maintainers may also remove the stale label at their discretion. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.