<p>I need to retrieve SA token using output in my pipeline, i found an solution in here</p>
<p><a href="https://stackoverflow.com/questions/56080359/retrieve-token-data-from-kubernetes-service-account-in-terraform">Retrieve token data from Kubernetes Service Account in Terraform</a></p>
<p>but still dont work and get this error:</p>
<pre><code>│ Error: Invalid function argument
│ 
│   on access.tf line 51, in output &quot;deploy_user_token&quot;:
│   51:   value = lookup(data.kubernetes_secret.deploy_user_secret.data, &quot;token&quot;)
│     ├────────────────
│     │ data.kubernetes_secret.deploy_user_secret.data has a sensitive value
│ 
│ Invalid value for &quot;inputMap&quot; parameter: argument must not be null.
</code></pre>
<p>My code:</p>
<pre><code>resource &quot;kubernetes_service_account&quot; &quot;deploy_user&quot; {
  depends_on = [kubernetes_namespace.namespace]
  metadata {
    name      = &quot;deploy-user&quot;
    namespace = var.namespace
  }
}

resource &quot;kubernetes_role&quot; &quot;deploy_user_full_access&quot; {
  metadata {
    name      = &quot;deploy-user-full-access&quot;
    namespace = var.namespace
  }

  rule {
    api_groups = [&quot;&quot;, &quot;extensions&quot;, &quot;apps&quot;, &quot;networking.istio.io&quot;]
    resources  = [&quot;*&quot;]
    verbs      = [&quot;*&quot;]
  }
  rule {
    api_groups = [&quot;batch&quot;]
    resources  = [&quot;jobs&quot;, &quot;cronjobs&quot;]
    verbs      = [&quot;*&quot;]
  }
}

resource &quot;kubernetes_role_binding&quot; &quot;deploy_user_view&quot; {
  metadata {
    name      = &quot;deploy-user-view&quot;
    namespace = var.namespace
  }
  role_ref {
    api_group = &quot;rbac.authorization.k8s.io&quot;
    kind      = &quot;Role&quot;
    name      = kubernetes_role.deploy_user_full_access.metadata.0.name
  }
  subject {
    kind      = &quot;ServiceAccount&quot;
    name      = kubernetes_service_account.deploy_user.metadata.0.name
    namespace = var.namespace
  }
}

data &quot;kubernetes_secret&quot; &quot;deploy_user_secret&quot; {
  metadata {
    name = kubernetes_service_account.deploy_user.default_secret_name
  }
}

output &quot;deploy_user_token&quot; {
  value = lookup(data.kubernetes_secret.deploy_user_secret.data, &quot;token&quot;)
}
</code></pre>
<p>someone have an idea that what i do wrong?</p>
<p>Thanks!</p>

mzibit
<p>it seems that you missing the namespace declaration on your data object, you need it to look like that:</p>
<pre><code>data &quot;kubernetes_secret&quot; &quot;deploy_user_secret&quot; {
  metadata {
    name = kubernetes_service_account.deploy_user.default_secret_name
    namespace = var.namespace
  }
}
</code></pre>
<p>you also need the set <code>sensitive = true</code> on your output:</p>
<pre><code>output &quot;deploy_user_token&quot; {
  sensitive = true
  value = lookup(data.kubernetes_secret.deploy_user_secret.data, &quot;token&quot;)
}
</code></pre>
