<p><strong>given is following scenario</strong></p>
<ul>
<li>Terraform is used to generate 2 Kubernetes Namespaces</li>
<li><strong>Namespace A</strong> contains RabbitMQ
<ul>
<li>RabbitMQ is installed via HELM-chart via terraform</li>
<li>Password-secret for RabbitMQ is generated, if not set, in HELM-chart</li>
</ul>
</li>
<li><strong>Namespace B</strong> contains applications which access RabbitMQ
<ul>
<li>Therefor the password-secret needs to be copied from <strong>A -&gt; B</strong> (or generated in B)</li>
</ul>
</li>
</ul>
<hr />
<p>How do I get the secret into namespace B with <strong>pure terraform logic</strong>?</p>
<p><strong>My ideas:</strong></p>
<ul>
<li>simply copy secret from <strong>A -&gt; B</strong> (was not able to find a solution for that)</li>
<li>read the password value from secret in <strong>A</strong> and create a new secret in <strong>B</strong> (was only able to find solutions where the secret was initially generated by terraform)</li>
<li>generate the password-secret with terraform &quot;random_password&quot;-resource and use it in the helm-chart
<ul>
<li>could work if I can have a conditional check if a terraform var is not set = generate, else use the var-value</li>
</ul>
</li>
</ul>
<p>Are there good solutions for that problem?</p>

masterchris_99
<p>Terraform's kubernetes provider appears to have a kubernetes_secret data source:
<a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret" rel="nofollow noreferrer">https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret</a></p>
<p>So theoretically at least, depending on the K8s credentials you are willing to provide to terraform while running the config, you may be able to just add a data source to the config for Namespace B:</p>
<pre><code>data &quot;kubernetes_secret&quot; &quot;rabbit_password&quot; {
  metadata {
    name = &quot;rabbit_password&quot;
    namespace = &quot;namespace_a&quot;
  }
}
</code></pre>
<p>And then refer to the data where you need it as:</p>
<pre><code>data.kubernetes_secret.rabbit_password.data[&quot;rabbitmq-password&quot;]
</code></pre>
