Terraform Kubernetes Secrets not applying due to Namespace

Question

I am learning terraform and trying to translate kubernetes infrastructure over to terraform.

I have a terraform script which creates a given namespace, and then creates secrets from local files. Most of the files do not create properly due to the namespace not being created fast enough.

Is there a correct method to create and wait for confirmation of the name space before continuing within the terraform script? Such as depends_on, etc.?

My current approach:

resource "kubernetes_namespace" "namespace" {
  metadata {
    name = "specialNamespace"
  }
}

resource "kubernetes_secret" "api-env" {
  metadata {
    name      = var.k8s_name_api_env
    namespace = "specialNamespace"
  }

  data = {
    ".api" = file("${path.cwd},${var.local_dir_path_api_env_file}")
  }
}

resource "kubernetes_secret" "password-env" {
  metadata {
    name      = var.k8s_name_password_env
    namespace = "specialNamespace"
  }

  data = {
    ".password" = file("${path.cwd},${var.local_dir_path_password_env_file}")
  }
}

resource "kubernetes_secret" "tls-crt-env" {
  metadata {
    name      = var.k8s_name_tls_crt_env
    namespace = "specialNamespace"
  }

  data = {
    "server.crt" = file("${path.cwd},${var.local_dir_path_tls_crt_env_file}")
  }
}

resource "kubernetes_secret" "tls-key-env" {
  metadata {
    name      = var.k8s_name_tls_key_env
    namespace = "specialNamespace"
  }

  data = {
    "server.key" = file("${path.cwd},${var.local_dir_path_tls_key_env_file}")
  }
}

I'd definitely try with an implicit dependency. – Marko E Jul 28 '22 at 20:59 — Marko E, Jul 28 '22 at 20:59

score 4 · Accepted Answer · answered Jul 28 '22 at 21:03

Since there is a way to get the name property of the metadata from the kubernetes_namespace resource, I would advise going with that. For example, for the kubernetes_secret resource:

resource "kubernetes_secret" "api-env" {
  metadata {
    name      = var.k8s_name_api_env
    namespace = kubernetes_namespace.namespace.metadata[0].name
  }

  data = {
    ".api" = file("${path.cwd},${var.local_dir_path_api_env_file}")
  }
}

Also, note that most of the resources also have the _v1 version (e.g., namespace [1], secret [2] etc.), so I would strongly suggest going with those ones.

[1] https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1

[2] https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1

This worked, in v1 and non-v1 format, thanks! Thank you for giving me these very helpful tips! Why is your implicit approach better than `depends_on` other than just less lines of code? — Matt - Block-Farms.io, Jul 29 '22 at 07:15
Well, I prefer implicit because it then makes sure terraform walks the graph in a more logical way (at least to me). It is also my opinion that using `depends_on` should be reserved for the cases where you cannot make any other logical connection between two resources. But in the end it's a matter of preference. — Marko E, Jul 29 '22 at 07:38

score 2 · Answer 2 · answered Jul 28 '22 at 20:06

2

Such as depends_on, etc.?

Exactly. Here, you should use depends_on:

resource "kubernetes_secret" "api-env" {
  depends_on = [resource.kubernetes_namespace.namespace]
  ...
}
...

answered Jul 28 '22 at 20:06

SYN

4,476
1
20
22

I like Marko E's suggestion of creating an implicit dependency better, in cases where that's possible. But this is also a very good and valid answer as well, and thank you for showing how that's done with example code. – Todd Walton Oct 05 '22 at 14:10

Terraform Kubernetes Secrets not applying due to Namespace

2 Answers2