<p>I can use <code>terraform</code> to deploy a <code>Kubernetes</code> cluster in <code>GKE</code>.</p>

<p>Then I have set up the provider for <code>Kubernetes</code> as follows:</p>

<pre><code>provider "kubernetes" {
  host                    = "${data.google_container_cluster.primary.endpoint}"

  client_certificate      = "${base64decode(data.google_container_cluster.primary.master_auth.0.client_certificate)}"
  client_key              = "${base64decode(data.google_container_cluster.primary.master_auth.0.client_key)}"
  cluster_ca_certificate  = "${base64decode(data.google_container_cluster.primary.master_auth.0.cluster_ca_certificate)}"
}
</code></pre>

<p>By default, <code>terraform</code> interacts with <code>Kubernetes</code> with the user <code>client</code>, which has no power to create (for example) deployments. So I get this error when I try to apply my changes with <code>terraform</code>:</p>

<pre><code>Error: Error applying plan:

1 error(s) occurred:

 * kubernetes_deployment.foo: 1 error(s) occurred:

 * kubernetes_deployment.foo: Failed to create deployment: deployments.apps is forbidden: User "client" cannot create deployments.apps in the namespace "default"
</code></pre>

<p>I don't know how should I proceed now, how should I give this permissions to the <code>client</code> user?</p>

<p>If the following fields are added to the provider, I am able to perform deployments, although after reading the documentation it seems these credentials are used for <code>HTTP</code> communication with the cluster, which is insecure if it is done through the internet.</p>

<pre><code>username              = "${data.google_container_cluster.primary.master_auth.0.username}"
password              = "${data.google_container_cluster.primary.master_auth.0.password}"
</code></pre>

<p>Is there any other better way of doing so?</p>

Navarro
<ul>
<li>you can use the service account that are running the terraform  </li>
</ul>

<pre><code>data "google_client_config" "default" {}

provider "kubernetes" {
  host     = "${google_container_cluster.default.endpoint}"

  token = "${data.google_client_config.default.access_token}"
  cluster_ca_certificate = "${base64decode(google_container_cluster.default.master_auth.0.cluster_ca_certificate)}"

  load_config_file = false
}
</code></pre>

<p>OR </p>

<ul>
<li>give permissions to the default "client"</li>
<li>But you need a valid authentication on GKE cluster provider to run this :/ <em>ups circular dependency here</em> </li>
</ul>

<pre><code>resource "kubernetes_cluster_role_binding" "default" {
  metadata {
    name = "client-certificate-cluster-admin"
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind = "ClusterRole"
    name = "cluster-admin"
  }
  subject {
    kind = "User"
    name = "client"
    api_group = "rbac.authorization.k8s.io"
  }
  subject {
    kind = "ServiceAccount"
    name = "default"
    namespace = "kube-system"
  }
  subject {
    kind = "Group"
    name = "system:masters"
    api_group = "rbac.authorization.k8s.io"
  }
}
</code></pre>
