<p>i have a terraform config that create a kubernetes(GKE) on GCP, install ingress and cert-manager using Helm.
the only part missing is the letsencrypt ClusterIssuer (when i deploy the letsencrypt.yaml manually all works fine).</p>
<p>my Terraform config:</p>
<pre><code># provider
provider &quot;kubernetes&quot; {
  host                   = google_container_cluster.runners.endpoint
  cluster_ca_certificate = base64decode(google_container_cluster.runners.master_auth.0.cluster_ca_certificate)
  token                  = data.google_client_config.current.access_token
}

provider &quot;helm&quot; {
  kubernetes {
      host                   = google_container_cluster.runners.endpoint
      cluster_ca_certificate = base64decode(google_container_cluster.runners.master_auth.0.cluster_ca_certificate)
      token                  = data.google_client_config.current.access_token
  }
}

# create namespace for ingress controller
resource &quot;kubernetes_namespace&quot; &quot;ingress&quot; {
  metadata {
    name = &quot;ingress&quot;
  }
}
# deploy ingress controller
resource &quot;helm_release&quot; &quot;ingress&quot; {
  name       = &quot;ingress&quot;
  namespace = kubernetes_namespace.ingress.metadata[0].name

  repository = &quot;https://kubernetes.github.io/ingress-nginx&quot;
  chart      = &quot;ingress-nginx&quot;

  values = [
    &quot;${file(&quot;./helm_values/ingress.yaml&quot;)}&quot;
  ]
  set {
    name  = &quot;controller.service.loadBalancerIP&quot;
    value = google_compute_address.net_runner.address
  }
}

#create namespace for cert mananger
resource &quot;kubernetes_namespace&quot; &quot;cert&quot; {
  metadata {
    name = &quot;cert-manager&quot;
  }
}

#deploy cert maanger
resource &quot;helm_release&quot; &quot;cert&quot; {
  name       = &quot;cert-manager&quot;
  namespace = kubernetes_namespace.cert.metadata[0].name
  repository = &quot;https://charts.jetstack.io&quot;
  chart      = &quot;cert-manager&quot;
  depends_on = [&quot;helm_release.ingress&quot;]
  set {
    name  = &quot;version&quot;
    value = &quot;v1.4.0&quot;
  }
  set {
    name  = &quot;installCRDs&quot;
    value = &quot;true&quot;
  }
}

</code></pre>
<p>my letsencrypt.yaml:</p>
<pre><code>apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: example@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
</code></pre>
<p>any idea how to deploy the ClusterIssuer using terraform?</p>

<p>You can apply the directly <strong>YAML</strong> file to the cluster</p>
<pre><code>provisioner &quot;local-exec&quot; {
    command = &lt;&lt;EOT
cat &lt;&lt;EOF | kubectl --server=${aws_eks_cluster.demo.endpoint} --insecure-skip-tls-verify=true --token=${data.aws_eks_cluster_auth.demo.token} create -f -
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: lets-encrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: mymail@gmail.com
    privateKeySecretRef:
      name: letsencrypt
    http01: {}
EOF
EOT
  }
</code></pre>
<p>or else you can also use the <strong>TF</strong> <strong>provider</strong> to apply the <strong>YAML</strong> file</p>
<p><a href="https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs#installation" rel="nofollow noreferrer">https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs#installation</a></p>
<p><strong>update</strong> :</p>
<p>if you have not set up the Kubernetes provider to <strong>authenticate</strong> you can use from :
<a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs" rel="nofollow noreferrer">https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs</a></p>
<pre><code>provider &quot;kubernetes&quot; {
  config_path    = &quot;~/.kube/config&quot;
  config_context = &quot;my-context&quot;
}

resource &quot;kubernetes_namespace&quot; &quot;example&quot; {
  metadata {
    name = &quot;my-first-namespace&quot;
  }
}
</code></pre>
