<h1>Question:</h1>

<p>I try to create a kubernetes cluster, namespace and secrets via terraform. 
The cluster is created, but the resources building upon the cluster fail to be created.</p>

<h1>Background information</h1>

<h2>Error message:</h2>

<p>This is the error message thrown by terraform after creation of the kubernetes cluster, when the namespace is to be created:</p>

<pre><code>azurerm_kubernetes_cluster_node_pool.mypool: Creation complete after 6m4s [id=/subscriptions/aaabcde1-abcd-abcd-abcd-aaaaaaabdce/resourcegroups/myrg/providers/Microsoft.ContainerService/managedClusters/my-aks/agentPools/win]        
Error: Post https://my-aks-abcde123.hcp.australiaeast.azmk8s.io:443/api/v1/namespaces: dial tcp: lookup my-aks-abcde123.hcp.australiaeast.azmk8s.io on 10.128.10.5:53: no such host

  on mytf.tf line 114, in resource "kubernetes_namespace" "my":
 114: resource "kubernetes_namespace" "my" {
</code></pre>

<h2>Manual workaround:</h2>

<p>I can resolve this by manually authenticating against the kubernetes cluster via the command line and applying the outstanding terraform changes via another <code>terraform apply</code>:</p>

<pre><code>az aks get-credentials -g myrg -n my-aks --overwrite-existing
</code></pre>

<h2>Automated workaround attempt:</h2>

<p>My attempt to automate this authentication step failed. I have tried with a local exec provisioner inside the definition of the kubernetes cluster, without success:</p>

<pre><code>resource "azurerm_kubernetes_cluster" "myCluster" {
  name                = "my-aks"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "my-aks"
  network_profile {
    network_plugin      = "azure"
  }

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_B2s"
  }
  service_principal {
    client_id     = azuread_service_principal.tfapp.application_id
    client_secret = azuread_service_principal_password.tfapp.value
  }
  tags = {
    Environment = "demo"
  }
  windows_profile {
    admin_username = "myself"
    admin_password = random_string.password.result
  }
  provisioner "local-exec" {
    command="az aks get-credentials -g myrg -n my-aks --overwrite-existing"
  }
}
</code></pre>

<p>This is an example of a resource that fails to be created:</p>

<pre><code>resource "kubernetes_namespace" "my" {
  metadata {
    name = "my-namespace"
  }
}
</code></pre>

<p>Is there a way to fully automate the creation of my resources, including those that are based on the kubernetes cluster, without manual authentication?</p>

<p>Eventually got this to work, without any requiredment to use AZ LOGIN, or AZ AKS GET-CREDENTIALS null_resource or local-exec provisioners as suggested above etc.</p>
<p>Instead used a data block in main.tf to obtain the AKS Cluster (output from AKS module), and use the KUBE ADMIN CONFIG from the DATA as credentials for the Kubernetes Provider block. See below:</p>
<pre><code>  data &quot;azurerm_kubernetes_cluster&quot; &quot;aks&quot; {
  name                = local.aks_cluster_name
  resource_group_name = module.infra_resource_group.rg.name

  depends_on = [
    module.aks.aks_cluster
  ]
}

  provider &quot;kubernetes&quot; {
  host                   = data.azurerm_kubernetes_cluster.aks.kube_admin_config.0.host
  client_certificate     = base64decode(data.azurerm_kubernetes_cluster.aks.kube_admin_config.0.client_certificate)
  client_key             = base64decode(data.azurerm_kubernetes_cluster.aks.kube_admin_config.0.client_key)
  cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.aks.kube_admin_config.0.cluster_ca_certificate)
}
</code></pre>
<p>NOTE: Found that using KUBE_CONFIG in the Kubernetes Provider block did not work. It needed higher permissions, hence why used the KUBE_ADMIN_CONFIG attribute instead</p>
<p>Using:</p>
<ul>
<li>Terraform v0.15.0</li>
<li>AzureRM Provider 2.60.0</li>
<li>Kubernetes Provider 2.2.0</li>
</ul>
