<p>I have launched a <strong>private</strong> <a href="https://www.terraform.io/docs/providers/google/r/container_cluster.html" rel="nofollow noreferrer">GKE cluster</a> using terraform resource <code>"google_container_cluster"</code> with a <code>private_cluster_config</code> block in it.</p>

<p>I have added <code>master_authorized_networks_config</code> to allow my own IP address in authorized networks for the GKE.</p>

<p>And I have added <a href="https://www.terraform.io/docs/providers/kubernetes/r/namespace.html" rel="nofollow noreferrer">k8s namespace</a> using terraform resource <code>"kubernetes_namespace"</code>.</p>

<p>I have also set all google, kubernetes providers, k8s token, cluster_ca_certificate etc correctly and the namespace was indeed provisioned by this terraform.</p>

<hr>

<pre><code>resource "google_container_cluster" "k8s_cluster" {
  # .....
  # .....
  private_cluster_config {
    enable_private_nodes = true
    enable_private_endpoint = false
    master_ipv4_cidr_block = "172.16.0.0/28"
  }
  ip_allocation_policy { } # enables VPC-native
  master_authorized_networks_config {
    cidr_blocks {
      {
        cidr_block = "0.0.0.0/0"
        display_name = "World"
      }
    }
  }
  # .....
  # .....
}
</code></pre>

<pre><code>data "google_client_config" "google_client" {}

data "google_container_cluster" "k8s_cluster" {
  name     = google_container_cluster.k8s_cluster.name
  location = var.location
}

provider "kubernetes" {
  # following this example https://www.terraform.io/docs/providers/google/d/datasource_client_config.html#example-usage-configure-kubernetes-provider-with-oauth2-access-token
  version = "1.11.1"
  load_config_file = false
  host = google_container_cluster.k8s_cluster.endpoint
  token = data.google_client_config.google_client.access_token
  cluster_ca_certificate = base64decode(
    data.google_container_cluster.k8s_cluster.master_auth.0.cluster_ca_certificate
  )
}

resource "kubernetes_namespace" "namespaces" {
  depends_on = [google_container_node_pool.node_pool]
  for_each = ["my-ns"]
  metadata {
    name = each.value
  }
}
</code></pre>

<hr>

<p>Then I ran <code>terraform apply</code> and the namespace was created fine ✅✅✅</p>

<pre><code>kubernetes_namespace.namespaces["my-ns"]: Creating...
kubernetes_namespace.namespaces["my-ns"]: Creation complete after 1s [id=my-ns]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
</code></pre>

<hr>

<p>However, when I run <code>terraform apply</code> or <code>terraform plan</code> again and terraform is trying to refresh the namespace resource, </p>

<pre><code>data.google_container_cluster.k8s_cluster: Refreshing state...
kubernetes_namespace.namespaces["my-ns"]: Refreshing state... [id=my-ns]
</code></pre>

<p>it's throwing the following error <strong>intermittently</strong>. ❌ ❌ ❌</p>

<pre><code>Error: Get http://localhost/api/v1/namespaces/my-ns: dial tcp 127.0.0.1:80: connect: connection refused
</code></pre>

<p>It's sometimes passing and sometimes failing - <strong>intermittently</strong>.</p>

<hr>

<p>Where would you advise I should look into to fix this intermittent error?</p>

Rakib
<p>In my case, the source of the issue was <a href="https://www.terraform.io/docs/commands/import.html#provider-configuration" rel="nofollow noreferrer">this</a>:</p>
<blockquote>
<p>The only limitation Terraform has when reading the configuration files is that the import provider configurations must not depend on non-variable inputs</p>
</blockquote>
<p>In your case, your kubernetes <code>provider</code> block has several config options that are variables:</p>
<pre><code>  host = google_container_cluster.k8s_cluster.endpoint
  token = data.google_client_config.google_client.access_token
</code></pre>
<p>My workaround was to create a kubeconfig.yaml file and temporarily replace the provider config with something like the following:</p>
<pre><code>provider &quot;kubernetes&quot; {
  config_path = &quot;kubeconfig.yaml&quot;
}
</code></pre>
<p>This allowed me to run the import, and then I restored the previous variable-based config.</p>
