<p>I have a RBAC enabled AKS cluster and want to configure a Kubernetes provider in Terraform for this cluster. I want to read the cluster as a data resource and pass credentials to my provider. The Azure login during execution context is a member of an AD group that has been added as administrator group on the cluster.</p>
<p>Running below terraform script throws an unauthorized error when trying to create a namespace in the cluster.</p>
<p><code>main.tf</code></p>
<pre><code>terraform {
  required_providers {
    azurerm = {
      source = &quot;hashicorp/azurerm&quot;
      version = &quot;=2.73.0&quot;
    }
    kubernetes = {
      source = &quot;hashicorp/kubernetes&quot;
      version = &quot;=2.4.1&quot;
    }
  }
}

provider &quot;azurerm&quot; {
  features {}
}

data &quot;azurerm_kubernetes_cluster&quot; &quot;k8s&quot; {
  name                = var.aks.name
  resource_group_name = var.aks.rg_name
}

provider &quot;kubernetes&quot; {
  host    = data.azurerm_kubernetes_cluster.k8s.kube_config.0.host

  client_certificate     = base64decode(data.azurerm_kubernetes_cluster.k8s.kube_config.0.client_certificate)
  client_key             = base64decode(data.azurerm_kubernetes_cluster.k8s.kube_config.0.client_key)
  cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.k8s.kube_config.0.cluster_ca_certificate)
}

resource &quot;kubernetes_namespace&quot; &quot;ns&quot; {
  metadata {
    name = &quot;test&quot;
  }
}
</code></pre>
<p><code>variables.tf</code></p>
<pre><code>variable &quot;aks&quot; {
  type = object({
    rg_name = string
    name    = string
  })
  description = &quot;AKS details&quot;
}
</code></pre>
<p>Execution</p>
<pre class="lang-sh prettyprint-override"><code>scripts&gt; terraform apply -auto-approve                                                                                                                                                                       cem-ms-deploy/git/develop !+

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # kubernetes_namespace.ns will be created
  + resource &quot;kubernetes_namespace&quot; &quot;ns&quot; {
      + id = (known after apply)

      + metadata {
          + generation       = (known after apply)
          + name             = &quot;test&quot;
          + resource_version = (known after apply)
          + uid              = (known after apply)
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.
kubernetes_namespace.ns: Creating...
╷
│ Error: Unauthorized
│ 
│   with kubernetes_namespace.ns,
│   on stackoverflow.tf line 31, in resource &quot;kubernetes_namespace&quot; &quot;ns&quot;:
│   31: resource &quot;kubernetes_namespace&quot; &quot;ns&quot; {
│ 
╵
</code></pre>

kjd
<p>The trace logs indicate that the <code>kube_config</code> object has empty value for several fields that are passed to the provider. Therefore, it causes the unauthorized error. The correct object to use here, with RBAC enabled AKS cluster, is the <code>kube_admin_config</code>. Updating the provider configuration to read credentials from <code>kube_admin_config</code> object fixed the issue.</p>
<p>Fixed Provider Config:</p>
<pre><code>provider &quot;kubernetes&quot; {
  host    = data.azurerm_kubernetes_cluster.k8s.kube_admin_config.0.host

  client_certificate     = base64decode(data.azurerm_kubernetes_cluster.k8s.kube_admin_config.0.client_certificate)
  client_key             = base64decode(data.azurerm_kubernetes_cluster.k8s.kube_admin_config.0.client_key)
  cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.k8s.kube_admin_config.0.cluster_ca_certificate)
}
</code></pre>
<p><a href="https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#kube_admin_config" rel="nofollow noreferrer">Provider Documentation</a></p>
