<p>I have created a cluster, I am trying to test few use cases. Whenever I try to update the existing terraform and give <strong>terraform apply</strong> It force replaces my AKS cluster.</p>
<p>Is there anything related to <strong>kube_admin_config</strong>?</p>
<p>My terraform plan(second plan) returns something like below</p>
<pre><code>module.aks.azurerm_kubernetes_cluster.k8s must be replaced
-/+ resource &quot;azurerm_kubernetes_cluster&quot; &quot;k8s&quot; {
      - api_server_authorized_ip_ranges = [] -&gt; null
      - enable_pod_security_policy      = false -&gt; null
      + fqdn                            = (known after apply)
      ~ id                              = &quot;/subscriptions/*****/providers/Microsoft.ContainerService/managedClusters/aks-cluster-destroy&quot; -&gt; (known after apply)
      ~ kube_admin_config               = [
          - {
              - client_certificate     = &quot;----*************************************************----&quot;
              - client_key             = &quot;----*************************************************----&quot;
              - cluster_ca_certificate = &quot;----*************************************************----&quot;
              - host                   = &quot;----*************************************************----&quot;
              - password               = &quot;----*************************************************----&quot;
              - username               = &quot;clusterAdmin_rg-aks-cluster-destroy_ask-cluster-destroy&quot;
            },
        ] -&gt; (known after apply)
      ~ kube_admin_config_raw           = (sensitive value)
      ~ kube_config                     = [
          - {
              - client_certificate     = &quot;&quot;
              - client_key             = &quot;&quot;
              - cluster_ca_certificate = &quot;&quot;
              - host                   = &quot;&quot;
              - password               = &quot;----*************************************************----&quot;
              - username               = &quot;clusterUser_rg-aks-cluster-destroy_ask-cluster-destroy&quot;
            },
        ] -&gt; (known after apply)

</code></pre>

Hariprasath
<p>Just ignore the <code>kube_admin_config</code> and <code>kube_config</code> sections during the terraform plan using the appropriate lifecycle configuration in Terraform.</p>
<p>Just add this piece of code to the resource &quot;k8s&quot; declaration inside the module code:</p>
<pre><code>  lifecycle {
    ignore_changes = [
      &quot;kube_admin_config&quot;,
      &quot;kube_config&quot;
    ]
  }
</code></pre>
<p>In general, this is a safe practice as those values are no updatable no matter what (in fact you would need to regenerate the master node to change them, aka rebuild the cluster).</p>
<p>You can also eliminate false &quot;changes&quot; by setting the other changing values to a value instead of leaving them out:</p>
<pre><code>api_server_authorized_ip_ranges = []
enable_pod_security_policy = false
</code></pre>
