<p>I am setting up External-DNS with Terraform. <a href="https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/azure.md" rel="nofollow noreferrer">Per the documentation</a>, I have to manually create an <code>azure.json</code> file and mount it as a secret volume. The directions also state:</p>
<blockquote>
<p>The Azure DNS provider expects, by default, that the configuration
file is at /etc/kubernetes/azure.json</p>
</blockquote>
<pre><code>{
  &quot;tenantId&quot;: &quot;01234abc-de56-ff78-abc1-234567890def&quot;,
  &quot;subscriptionId&quot;: &quot;01234abc-de56-ff78-abc1-234567890def&quot;,
  &quot;resourceGroup&quot;: &quot;MyDnsResourceGroup&quot;,
  &quot;aadClientId&quot;: &quot;01234abc-de56-ff78-abc1-234567890def&quot;,
  &quot;aadClientSecret&quot;: &quot;uKiuXeiwui4jo9quae9o&quot;
}
</code></pre>
<p>I then run <code>kubectl create secret generic azure-config-file --from-file=/local/path/to/azure.json</code> to mount the secret as a file.</p>
<p>The problem is that those values are dynamic, and I need to do this automatically per a CI/CD pipeline. I'm using Terraform Kubernetes resources, and here I've used the <code>kubernetes_secret</code> resource.</p>
<pre><code>resource &quot;kubernetes_secret&quot; &quot;azure_config_file&quot; {
  metadata {
    name = &quot;azure-config-file&quot;
  }

  data = {
    tenantId = data.azurerm_subscription.current.tenant_id
    subscriptionId = data.azurerm_subscription.current.subscription_id
    resourceGroup = azurerm_resource_group.k8s.name
    aadClientId = azuread_application.sp_externaldns_connect_to_dns_zone.application_id
    aadClientSecret = azuread_application_password.sp_externaldns_connect_to_dns_zone.value
  }

  depends_on = [
    kubernetes_namespace.external_dns,
  ]
}
</code></pre>
<p>The secret gets mounted, but the pod never sees it and it results in a crashLoopBackoff. This may not be the best direction.</p>
<p>How do I automate this process with Terraform and get it mounted correctly?</p>
<p>For reference, this is the related section of the YAML manifest</p>
<pre><code>...

       volumeMounts:
        - name: azure-config-file
          mountPath: /etc/kubernetes
          readOnly: true
      volumes:
      - name: azure-config-file
        secret:
          secretName: azure-config-file
          items:
          - key: externaldns-config.json
            path: azure.json
</code></pre>

<p>This is the Terraform version of using the <code>--from-file</code> flag with kubectl.</p>
<p>Basically, you'll add the name of the file and its contents per the structure of the <code>data</code> block below.</p>
<pre><code>resource &quot;kubernetes_secret&quot; &quot;azure_config_file&quot; {
  metadata {
    name = &quot;azure-config-file&quot;
  }

  data = { &quot;azure.json&quot; = jsonencode({
    tenantId        = data.azurerm_subscription.current.tenant_id
    subscriptionId  = data.azurerm_subscription.current.subscription_id
    resourceGroup   = data.azurerm_resource_group.rg.name
    aadClientId     = azuread_application.sp_externaldns_connect_to_dns_zone.application_id
    aadClientSecret = azuread_application_password.sp_externaldns_connect_to_dns_zone.value
    })

  }
}
</code></pre>
