<p>In my terraform infrastructure, I spin up several Kubernetes clusters based on parameters, then install some standard contents to those Kubernetes clusters using the kubernetes provider.</p>

<p>When I change the parameters and one of the clusters is no longer needed, terraform is unable to tear it down because the provider and resources are both in the module. I don't see an alternative, however, because I create the kubernetes cluster in that same module, and the kubernetes object are all per kubernetes cluster.</p>

<p>All solutions I can think of involve adding a bunch of boilerplate to my terraform config. Should I consider generating my terraform config from a script?</p>

<hr>

<p>I made a git repo that shows exactly the problems I'm having:</p>

<p><a href="https://github.com/bukzor/terraform-gke-k8s-demo" rel="nofollow noreferrer">https://github.com/bukzor/terraform-gke-k8s-demo</a></p>

<h1>TL;DR</h1>

<p>Two solutions:</p>

<ol>
<li>Create two separate modules with Terraform</li>
<li><p>Use interpolations and depends_on between the code that creates your Kubernetes cluster and the kubernetes resources:</p>

<pre><code>resource "kubernetes_service" "example" {
  metadata {
    name = "my-service"
  }

  depends_on = ["aws_vpc.kubernetes"]
}

resource "aws_vpc" "kubernetes" {
  ...
}
</code></pre></li>
</ol>

<h1>When destroying resources</h1>

<p>You are encountering a dependency lifecycle issue</p>

<p><em>PS: I don't know the code you've used to create / provision your Kubernetes cluster but I guess it looks like this</em></p>

<ol>
<li>Write code for the Kubernetes cluster (creates a VPC)</li>
<li>Apply it</li>
<li>Write code for provisionning Kubernetes (create an Service that creates an ELB)</li>
<li>Apply it</li>
<li>Try to destroy everything => Error</li>
</ol>

<p>What is happenning is that by creating a <a href="https://kubernetes.io/docs/concepts/services-networking/#loadbalancer" rel="noreferrer">LoadBalancer Service</a>, Kubernetes will provision an ELB on AWS. But Terraform doesn't know that and there is no link between the ELB created and any other resources managed by Terraform.
So when terraform tries to destroy the resources in the code, it will try to destroy the VPC. But it can't because there is an ELB inside that VPC that terraform doesn't know about.
The first thing would be to make sure that Terraform "deprovision" the Kubernetes cluster and then destroy the cluster itself.</p>

<p>Two solutions here:</p>

<ol>
<li><p>Use different modules so there is no dependency lifecycle. For example the first module could be <code>k8s-infra</code> and the other could be <code>k8s-resources</code>. The first one manages all the squeleton of Kubernetes and is apply first / destroy last. The second one manages what is inside the cluster and is apply last / destroy first.</p></li>
<li><p>Use the <a href="https://www.terraform.io/docs/configuration/resources.html#depends_on" rel="noreferrer"><code>depends_on</code></a> parameter to write the dependency lifecycle explicitly</p></li>
</ol>

<h1>When creating resources</h1>

<p>You might also ran into a dependency issue when <code>terraform apply</code> cannot create resources even if nothing is applied yet. I'll give an other example with a postgres </p>

<ol>
<li>Write code to create an RDS PostgreSQL server</li>
<li>Apply it with Terraform</li>
<li>Write code, <strong>in the same module</strong>, to provision that RDS instance with the postgres terraform provider</li>
<li>Apply it with Terraform</li>
<li>Destroy everything</li>
<li>Try to apply everything => ERROR</li>
</ol>

<p>By debugging Terraform a bit I've learned that all the providers are initialized at the beggining of the <code>plan</code> / <code>apply</code> so if one has an invalid config (wrong API keys / unreachable endpoint) then Terraform will fail.</p>

<p>The solution here is to use the <a href="https://www.terraform.io/docs/commands/apply.html#target-resource" rel="noreferrer">target parameter</a> of a <code>plan</code> / <code>apply</code> command.
Terraform will only initialize providers that are related to the resources that are applied.</p>

<ol>
<li>Apply the RDS code with the AWS provider: <code>terraform apply -target=aws_db_instance</code></li>
<li>Apply everything <code>terraform apply</code>. Because the RDS instance is already reachable, the PostgreSQL provider can also initiate itself</li>
</ol>
