<p>I think just a quick sanity check, maybe my eyes are getting confused. I'm breaking a monolithic terraform file into modules. </p>

<p>My <code>main.tf</code> call just two modules, <code>gke</code> for the google kubernetes engine and <code>storage</code> which creates a persistent volume on the cluster created previously.</p>

<p>Module <code>gke</code> has an <code>outputs.tf</code> which outputs the following:</p>

<pre><code>output "client_certificate" {
  value     = "${google_container_cluster.kube-cluster.master_auth.0.client_certificate}"
 sensitive = true
}
output "client_key" {
  value     = "${google_container_cluster.kube-cluster.master_auth.0.client_key}"
 sensitive = true
}
output "cluster_ca_certificate" {
  value     = "${google_container_cluster.kube-cluster.master_auth.0.cluster_ca_certificate}"
 sensitive = true
}
output "host" {
  value     = "${google_container_cluster.kube-cluster.endpoint}"
 sensitive = true
}
</code></pre>

<p>Then in the <code>main.tf</code> for the storage module, I have:</p>

<pre><code>client_certificate     = "${base64decode(var.client_certificate)}"
client_key             = "${base64decode(var.client_key)}"
cluster_ca_certificate = "${base64decode(var.cluster_ca_certificate)}"
host     = "${var.host}"
</code></pre>

<p>Then in the root <code>main.tf</code> I have the following:</p>

<pre><code>client_certificate = "${module.gke.client_certificate}"
client_key = "${module.gke.client_key}"
cluster_ca_certificate = "${module.gke.cluster_ca_certificate}"
host = "${module.gke.host}"
</code></pre>

<p>From what I see, it looks right. The values for the certs, key and host variables should be outputted from the <code>gke</code> module by <code>outputs.tf</code>, picked up by <code>main.tf</code> of root, and then delivered to <code>storage</code> as a regular variable.</p>

<p>Have I got it the wrong way around? Or am I just going crazy, something doesn't seem right.</p>

<p>I get questioned about the variable not being filled when I run a plan.</p>

<p>EDIT:</p>

<p>Adding some additional information including my code.</p>

<p>If I manually add dummy entries for the variables it's asking for I get the following error:</p>

<pre><code>Macbook: $ terraform plan
var.client_certificate
  Enter a value: 1

var.client_key
  Enter a value: 2

var.cluster_ca_certificate
  Enter a value: 3

var.host
  Enter a value: 4
...
(filtered out usual text)
...
 * module.storage.data.google_container_cluster.kube-cluster: 1 error(s) occurred:

* module.storage.data.google_container_cluster.kube-cluster: data.google_container_cluster.kube-cluster: project: required field is not set
</code></pre>

<p>It looks like it's complaining that the data.google_container_cluster resource needs the project attribute. But it doesn't it's not a valid resource. It is for the provider, but it's filled out for provider.</p>

<p>Code below:</p>

<p>Folder structure:</p>

<pre><code>root-folder/
├── gke/
│   ├── main.tf
│   ├── outputs.tf
│   ├── variables.tf
├── storage/
│   ├── main.tf
│   └── variables.tf
├── main.tf
├── staging.json
├── terraform.tfvars
└── variables.tf
</code></pre>

<p>root-folder/gke/main.tf:</p>

<pre><code>provider "google" {
  credentials = "${file("staging.json")}"
  project     = "${var.project}"
  region      = "${var.region}"
  zone        = "${var.zone}"
}

resource "google_container_cluster" "kube-cluster" {
  name               = "kube-cluster"
  description        = "kube-cluster"
  zone               = "europe-west2-a"
  initial_node_count = "2"
  enable_kubernetes_alpha = "false"
  enable_legacy_abac = "true"

  master_auth {
    username = "${var.username}"
    password = "${var.password}"
  }

  node_config {
    machine_type = "n1-standard-2"
    disk_size_gb = "20"
    oauth_scopes = [
      "https://www.googleapis.com/auth/compute",
      "https://www.googleapis.com/auth/devstorage.read_only",
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring"
    ]
  }
}
</code></pre>

<p>root-folder/gke/outputs.tf:</p>

<pre><code>output "client_certificate" {
  value     = "${google_container_cluster.kube-cluster.master_auth.0.client_certificate}"
 sensitive = true
}
output "client_key" {
  value     = "${google_container_cluster.kube-cluster.master_auth.0.client_key}"
 sensitive = true
}
output "cluster_ca_certificate" {
  value     = "${google_container_cluster.kube-cluster.master_auth.0.cluster_ca_certificate}"
 sensitive = true
}
output "host" {
  value     = "${google_container_cluster.kube-cluster.endpoint}"
 sensitive = true
}
</code></pre>

<p>root-folder/gke/variables.tf:</p>

<pre><code>variable "region" {
  description = "GCP region, e.g. europe-west2"
  default = "europe-west2"
}
variable "zone" {
  description = "GCP zone, e.g. europe-west2-a (which must be in gcp_region)"
  default = "europe-west2-a"
}
variable "project" {
  description = "GCP project name"
}
variable "username" {
  description = "Default admin username"
}
variable "password" {
  description = "Default admin password"
}
</code></pre>

<p>/root-folder/storage/main.cf:</p>

<pre><code>provider "kubernetes" {
  host     = "${var.host}"
  username = "${var.username}"
  password = "${var.password}"
  client_certificate     = "${base64decode(var.client_certificate)}"
  client_key             = "${base64decode(var.client_key)}"
  cluster_ca_certificate = "${base64decode(var.cluster_ca_certificate)}"
}
data "google_container_cluster" "kube-cluster" {
  name   = "${var.cluster_name}"
  zone   = "${var.zone}"
}
resource "kubernetes_storage_class" "kube-storage-class" {
  metadata {
    name = "kube-storage-class"
  }
  storage_provisioner = "kubernetes.io/gce-pd"
  parameters {
    type = "pd-standard"
  }
}
resource "kubernetes_persistent_volume_claim" "kube-claim" {
  metadata {
    name      = "kube-claim"
  }
  spec {
    access_modes       = ["ReadWriteOnce"]
    storage_class_name = "kube-storage-class"
    resources {
      requests {
        storage = "10Gi"
      }
    }
  }
}
</code></pre>

<p>/root/storage/variables.tf:</p>

<pre><code>variable "username" {
  description = "Default admin username."
}
variable "password" {
  description = "Default admin password."
}
variable "client_certificate" {
  description = "Client certificate, output from the GKE/Provider module."
}
variable "client_key" {
  description = "Client key, output from the GKE/Provider module."
}
variable "cluster_ca_certificate" {
  description = "Cluster CA Certificate, output from the GKE/Provider module."
}
variable "cluster_name" {
  description = "Cluster name."
}
variable "zone" {
  description = "GCP Zone"
}
variable "host" {
  description = "Host endpoint, output from the GKE/Provider module."
}
</code></pre>

<p>/root-folder/main.tf:</p>

<pre><code>module "gke" {
  source = "./gke"
  project = "${var.project}"
  region = "${var.region}"
  username = "${var.username}"
  password = "${var.password}"
}
module "storage" {
  source = "./storage"
  host = "${module.gke.host}"
  username = "${var.username}"
  password = "${var.password}"
  client_certificate = "${module.gke.client_certificate}"
  client_key = "${module.gke.client_key}"
  cluster_ca_certificate = "${module.gke.cluster_ca_certificate}"
  cluster_name = "${var.cluster_name}"
  zone = "${var.zone}"
}
</code></pre>

<p>/root-folder/variables.tf:</p>

<pre><code>variable "project" {}
variable "region" {}
variable "username" {}
variable "password" {}
variable "gc_disk_size" {}
variable "kpv_vol_size" {}
variable "host" {}
variable "client_certificate" {}
variable "client_key" {}
variable "cluster_ca_certificate" {}
variable "cluster_name" {}
variable "zone" {}
</code></pre>

<p>I won't paste the contents of my <code>staging.json</code> and <code>terraform.tfvars</code> for obvious reasons :)</p>

<p>In your <code>/root-folder/variables.tf</code>, delete the following entries:</p>

<pre><code>variable "host" {}
variable "client_certificate" {}
variable "client_key" {}
variable "cluster_ca_certificate" {}
</code></pre>

<p>Those are not variables per se that the Terraform code at the root level needs. Instead, they are being passed as 1 module's output --> input to the 2nd module.</p>
