kubernetes_deployment affinity rules not applied

[david-garcia-garcia]

Description

The affinity rules declared in a terraform kubernetes_deployment are not propagated to the kubernetes deployment object.

After running terraform apply using the example, the deployment gets stuck in waiting for the deployment to start the pod, because it is scheduled on an incompatible node (K8S cluster with mixed windows and linux nodes).

After inspecting the deployed deployment in kubernetes:

 kubectl get deployment traefik-deployment -o json

I can see that the affinity rules have not been propagated to the kubernetes deployment configuration.

I can confirm that generating a kubernetes JSON for en equivalent deployment and applying directly using kubernetes does work:

kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik-deployment
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-account
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
      containers:
        - name: traefik
          image: traefik:v2.10
          args:
            - --api.insecure
            - --providers.kubernetesingress
          ports:
            - name: web
              containerPort: 80
            - name: dashboard
              containerPort: 8080

Running Terraform 1.6.6 and kubectl

Kubectl version:

Client Version: v1.29.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.3

Potential Terraform Configuration

resource "kubernetes_deployment" "traefik" {
  metadata {
    name   = "traefik-deployment"
    labels = {
      app = "traefik"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "traefik"
      }
    }

    template {
      metadata {
        labels = {
          app = "traefik"
        }
      }

      spec {
        service_account_name = "traefik-account"

        affinity {
          node_affinity {
            required_during_scheduling_ignored_during_execution {
              node_selector_term {
                match_expressions {
                  key = "kubernetes.io/os"
                  operator = "In"
                  values = ["linux"]
                }
              }
            }
          }
        }

        container {
          image = "traefik:v2.10"
          name  = "traefik"

          args = [
            "--api.insecure=true",
            "--accesslog",
            "--entrypoints.web.address=:80",
            "--providers.kubernetesingress"
          ]

          port {
            name          = "web"
            container_port = 80
          }

          port {
            name          = "webssl"
            container_port = 443
          }

          port {
            name          = "dashboard"
            container_port = 8080
          }
        }
      }
    }
  }
}

References

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[arybolovlev]

Closing this one as a duplicate of #2379.