<p>I'm using Terraform to provision an EKS cluster (mostly following the example <a href="https://learn.hashicorp.com/terraform/aws/eks-intro" rel="nofollow noreferrer">here</a>). At the end of the tutorial, there's a method of outputting the configmap through the <code>terraform output</code> command, and then applying it to the cluster via <code>kubectl apply -f &lt;file&gt;</code>. I'm attempting to wrap this <code>kubectl</code> command into the Terraform file using the <code>kubernetes_config_map</code> resource, however when running Terraform for the first time, I receive the following error:</p>

<pre><code>Error: Error applying plan:

1 error(s) occurred:

* kubernetes_config_map.config_map_aws_auth: 1 error(s) occurred:

* kubernetes_config_map.config_map_aws_auth: the server could not find the requested resource (post configmaps)
</code></pre>

<p>The strange thing is, every subsequent <code>terraform apply</code> works, and applies the configmap to the EKS cluster. This leads me to believe it is perhaps a timing issue? I tried to preform a bunch of actions in between the provisioning of the cluster and applying the configmap but that didn't work. I also put an explicit <code>depends_on</code> argument to ensure that the cluster has been fully provisioned first before attempting to apply the configmap.</p>

<pre><code>provider "kubernetes" {
  config_path = "kube_config.yaml"
}

locals {
  map_roles = &lt;&lt;ROLES
- rolearn: ${aws_iam_role.eks_worker_iam_role.arn}
  username: system:node:{{EC2PrivateDNSName}}
  groups:
    - system:bootstrappers
    - system:nodes
ROLES
}

resource "kubernetes_config_map" "config_map_aws_auth" {
  metadata {
    name      = "aws-auth"
    namespace = "kube-system"
  }

  data {
    mapRoles = "${local.map_roles}"
  }

  depends_on = ["aws_eks_cluster.eks_cluster"]
}
</code></pre>

<p>I expect for this to run correctly the first time, however it only runs after applying the same file with no changes a second time. </p>

<p>I attempted to get more information by enabling the <code>TRACE</code> debug flag for terraform, however the only output I got was the exact same error as above.</p>

jcploucha
<p>This seems like a timing issue while bootstrapping your cluster. Your <code>kube-apiserver</code> initially doesn't think there's a <code>configmaps</code> resource.</p>

<p>It's likely that the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer"><code>Role</code></a> and <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer"><code>RoleBinding</code></a> that it's using the create the ConfigMap has not been fully configured in the cluster to allow it to create a ConfigMap (possibly within the EKS infrastructure) which uses the <a href="https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html" rel="nofollow noreferrer">iam-authenticator</a> and the following policies:</p>

<pre><code>resource "aws_iam_role_policy_attachment" "demo-cluster-AmazonEKSClusterPolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = "${aws_iam_role.demo-cluster.name}"
}

resource "aws_iam_role_policy_attachment" "demo-cluster-AmazonEKSServicePolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = "${aws_iam_role.demo-cluster.name}"
}
</code></pre>

<p>The <code>depends</code> Terraform clause will not do much since it seems like the timing is happening within the EKS service.</p>

<p>I suggest you try the <a href="https://github.com/terraform-aws-modules/terraform-aws-eks" rel="nofollow noreferrer">terraform-aws-eks</a> module which uses the same resource described in the doc. You can also browse through the code if you'd like to figure out how they solve the problem that you are seeing.</p>
