Metadata annotations generate an internal Kubernetes annotation errors

[rpatrick00]

Terraform Version

Terraform v0.11.10

• provider.aws v1.41.0
• provider.kubernetes v1.3.0
• provider.null v1.0.0
• provider.template v1.0.0

Affected Resource(s)

• kubernetes_service

Terraform Configuration Files

Here is the relevant portion of my terraform script.

resource "kubernetes_service" "website-service" {
  metadata {
    name = "${var.website_name}-service"
    annotations {
      "service.beta.kubernetes.io/aws-load-balancer-backend-protocol" = "http"
      "service.beta.kubernetes.io/aws-load-balancer-ssl-ports" = "443"
      "service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled" = "true"
      "service.beta.kubernetes.io/aws-load-balancer-ssl-cert" = "${aws_iam_server_certificate.ssl-cert.arn}"
      "service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy" = "ELBSecurityPolicy-TLS-1-2-2017-01"
      "service.beta.kubernetes.io/aws-load-balancer-access-log-enabled" = "true"
      "service.beta.kubernetes.io/aws-load-balancer-access-log-emit-interval" = "60"
      "service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-name" = "${var.load_balancer_access_logs_bucket_name}"
      "service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-prefix" = "${var.load_balancer_access_log_bucket_prefix}"
    }
  }

  spec {
    type = "LoadBalancer"
    selector {
      app = "${var.website_name}"
    }
    port {
      name = "http"
      port = 80
      target_port = "${var.container_port}"
      protocol = "TCP"
    }
    port {
      name = "https"
      port = 443
      target_port = "${var.container_port}"   # ssl termination at the load balancer
      protocol = "TCP"
    }
  }

  depends_on = [
    "aws_s3_bucket_policy.elb-log-s3-access-policy",
    "kubernetes_deployment.website-deployment"
  ]
}

Debug Output

Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-access-log-emit-interval" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-access-log-enabled" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-name" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-prefix" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-backend-protocol" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-ssl-cert" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy" is internal Kubernetes annotation



Error: module.web.kubernetes_service.website-service: metadata.0.annotations: "service.beta.kubernetes.io/aws-load-balancer-ssl-ports" is internal Kubernetes annotation

Expected Behavior

Terraform should have provisioned my service.

Actual Behavior

Terraform generated errors for all of the annotations

Steps to Reproduce

terraform plan

Important Factoids

This service definition seemed to work fine with the latest forked version of the kubernetes provider from https://github.com/sl1pm4t/terraform-provider-kubernetes

[rpatrick00]

Looks like PR #199 will fix this issue. Please merge this fix since it is impossible to create services of type LoadBalancer for any of the major Cloud Providers without this (since you don't yet support Ingress...).