<p>I'm creating a Kubernetes Service Account using terraform and trying to output the token from the Kubernetes Secret that it creates.</p>

<pre><code>resource "kubernetes_service_account" "ci" {
  metadata {
    name = "ci"
  }
}

data "kubernetes_secret" "ci" {
  metadata {
    name = "${kubernetes_service_account.ci.default_secret_name}"
  }
}

output "ci_token" {
  value = "${data.kubernetes_secret.ci.data.token}"
}
</code></pre>

<p>According to <a href="https://www.terraform.io/docs/configuration-0-11/data-sources.html#data-source-lifecycle" rel="noreferrer">the docs</a> this should make the data block defer getting its values until the 'apply' phase because of the computed value of <code>default_secret_name</code>, but when I run <code>terraform apply</code> it gives me this error:</p>

<pre><code>Error: Error running plan: 1 error(s) occurred:

* output.ci_token: Resource 'data.kubernetes_secret.ci' does not have attribute 'data.token' for variable 'data.kubernetes_secret.ci.data.token'
</code></pre>

<p>Adding <code>depends_on</code> to the <code>kubernetes_secret</code> data block doesn't make any difference.</p>

<p>If I comment out the <code>output</code> block, it creates the resources fine, then I can uncomment it, apply again, and everything acts normally, since the Kubernetes Secret exists already.</p>

<p>I've also made a Github issue <a href="https://github.com/terraform-providers/terraform-provider-kubernetes/issues/436" rel="noreferrer">here</a>.</p>

<p><strong>Update</strong></p>

<p>The accepted answer does solve this problem, but I omitted another output to simplify the question, which doesn't work with this solution:</p>

<pre><code>output "ci_crt" {
  value = "${data.kubernetes_secret.ci.data.ca.crt}"
}
</code></pre>

<pre><code>* output.ci_ca: lookup: lookup failed to find 'ca.crt' in:

${lookup(data.kubernetes_secret.ci.data, "ca.crt")}
</code></pre>

<p>This particular issue is <a href="https://github.com/terraform-providers/terraform-provider-kubernetes/issues/334" rel="noreferrer">reported here</a> due to <a href="https://github.com/hashicorp/terraform/issues/10876" rel="noreferrer">a bug in Terraform</a>, which is fixed in version 0.12.</p>

<p>This works:</p>
<pre><code>resource &quot;kubernetes_service_account&quot; &quot;ci&quot; {
  metadata {
    name = &quot;ci&quot;
  }
}

data &quot;kubernetes_secret&quot; &quot;ci&quot; {
  metadata {
    name = kubernetes_service_account.ci.default_secret_name
  }
}

output &quot;ci_token&quot; {
  sensitive = true
  value = lookup(data.kubernetes_secret.ci.data, &quot;token&quot;)
}
</code></pre>
