<h1>Question:</h1>

<p>I try to create a kubernetes cluster, namespace and secrets via terraform. 
The cluster is created, but the resources building upon the cluster fail to be created.</p>

<h1>Background information</h1>

<h2>Error message:</h2>

<p>This is the error message thrown by terraform after creation of the kubernetes cluster, when the namespace is to be created:</p>

<pre><code>azurerm_kubernetes_cluster_node_pool.mypool: Creation complete after 6m4s [id=/subscriptions/aaabcde1-abcd-abcd-abcd-aaaaaaabdce/resourcegroups/myrg/providers/Microsoft.ContainerService/managedClusters/my-aks/agentPools/win]        
Error: Post https://my-aks-abcde123.hcp.australiaeast.azmk8s.io:443/api/v1/namespaces: dial tcp: lookup my-aks-abcde123.hcp.australiaeast.azmk8s.io on 10.128.10.5:53: no such host

  on mytf.tf line 114, in resource "kubernetes_namespace" "my":
 114: resource "kubernetes_namespace" "my" {
</code></pre>

<h2>Manual workaround:</h2>

<p>I can resolve this by manually authenticating against the kubernetes cluster via the command line and applying the outstanding terraform changes via another <code>terraform apply</code>:</p>

<pre><code>az aks get-credentials -g myrg -n my-aks --overwrite-existing
</code></pre>

<h2>Automated workaround attempt:</h2>

<p>My attempt to automate this authentication step failed. I have tried with a local exec provisioner inside the definition of the kubernetes cluster, without success:</p>

<pre><code>resource "azurerm_kubernetes_cluster" "myCluster" {
  name                = "my-aks"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "my-aks"
  network_profile {
    network_plugin      = "azure"
  }

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_B2s"
  }
  service_principal {
    client_id     = azuread_service_principal.tfapp.application_id
    client_secret = azuread_service_principal_password.tfapp.value
  }
  tags = {
    Environment = "demo"
  }
  windows_profile {
    admin_username = "myself"
    admin_password = random_string.password.result
  }
  provisioner "local-exec" {
    command="az aks get-credentials -g myrg -n my-aks --overwrite-existing"
  }
}
</code></pre>

<p>This is an example of a resource that fails to be created:</p>

<pre><code>resource "kubernetes_namespace" "my" {
  metadata {
    name = "my-namespace"
  }
}
</code></pre>

<p>Is there a way to fully automate the creation of my resources, including those that are based on the kubernetes cluster, without manual authentication?</p>

<p>For your requirements, I think you can separate the creation of the AKS cluster from the creation of the resources in the AKS cluster.</p>

<p>In the creation of the AKS cluster, you just need to put the provisioner <code>local-exec</code> in the <code>null_resource</code> like this:</p>

<pre><code>resource "null_resource" "example" {
  provisioner "local-exec" {
    command="az aks get-credentials -g ${azurerm_resource_group.rg.name} -n my-aks --overwrite-existing"
  }
}
</code></pre>

<p>When the AKS cluster creation is finished. Then you go to create your namespace through the Terraform again.</p>

<p>In this way, you do not need to manually authenticate. Just execute the Terraform code.</p>
