<p>I try to create resources based on variables.
<strong>variable.tf</strong></p>
<pre class="lang-tf prettyprint-override"><code>variable &quot;apps&quot; {
  default = null
  type = map(object({
      name          = string
      type          = string
      secrets       = optional(map(string))
  }))
}
</code></pre>
<p><strong>terraform.tfvars</strong></p>
<pre class="lang-hcl prettyprint-override"><code>apps = {

    &quot;myfirst&quot; = {
        name = &quot;myfirst&quot;
        type = &quot;deploy&quot;
        secrets = {
            &quot;FIRST_VAR&quot; = &quot;TestVariable&quot;,
            &quot;SECOND_VAR&quot; = &quot;SecontTestVariable&quot;,
            &quot;THIRD&quot; = &quot;NothingHere&quot;
        }
    },
    &quot;second&quot; ={
        name = &quot;second&quot;
        type = &quot;deploy&quot;
        secrets = {
            &quot;SECRET_VAR&quot; = &quot;SecretVar&quot;
        }
    },
    &quot;simlepod&quot; ={
        name = &quot;simplepod&quot;
        type = &quot;deploy&quot;
    },
    &quot;another&quot; ={
        name = &quot;another&quot;
        type = &quot;pod&quot;
</code></pre>
<p>And my <strong>main.tf</strong></p>
<pre class="lang-tf prettyprint-override"><code>terraform {
  required_providers {
    kubernetes = {
      source = &quot;hashicorp/kubernetes&quot;
      version = &quot;2.9.0&quot;
    }
  }
  experiments = [module_variable_optional_attrs]
}

provider &quot;kubernetes&quot; {
    config_path    = &quot;~/.kube/config&quot;
  # Configuration options
}

resource &quot;kubernetes_secret&quot; &quot;secret&quot; {
  
  for_each = { for k in compact([for k, v in var.apps: v.secrets != null ? k : &quot;&quot;]): k =&gt; var.apps[k] }


  metadata {
    name = &quot;${each.value.name}-secret&quot;
  }

  data = each.value[&quot;secrets&quot;]

}

resource &quot;kubernetes_pod&quot; &quot;test&quot; {

  for_each = { for k in compact([for k, v in var.apps: v.type ==&quot;deploy&quot; ? k : &quot;&quot;]): k =&gt; var.apps[k] }

  metadata {
    name = &quot;app-${each.value.name}&quot;
  }

  spec {
    container {
      image = &quot;nginx:1.21.6&quot;
      name  = &quot;test-${each.value.name}&quot;

      
      env_from {
        secret_ref {
          name = kubernetes_secret.secret[each.value.name].metadata[0].name
        }
      }

      resources {
        limits = {
          cpu          = &quot;0.5&quot;
          memory       = &quot;512Mi&quot;
        }

        requests = {
          cpu          = &quot;250m&quot;
          memory       = &quot;50Mi&quot;
        }
      }
    }
  }

  timeouts {
    create = &quot;60s&quot;

  }
}
</code></pre>
<p>And this produces error because not all objects in <code>apps</code> have <code>secret</code> variable.</p>
<pre class="lang-hcl prettyprint-override"><code> terraform plan
╷
│ Warning: Experimental feature &quot;module_variable_optional_attrs&quot; is active
│ 
│   on main.tf line 8, in terraform:
│    8:   experiments = [module_variable_optional_attrs]
│ 
│ Experimental features are subject to breaking changes in future minor or patch
│ releases, based on feedback.
│ 
│ If you have feedback on the design of this feature, please open a GitHub issue to
│ discuss it.
╵
╷
│ Error: Unsupported block type
│ 
│   on main.tf line 68, in resource &quot;kubernetes_pod&quot; &quot;test&quot;:
│   68:   dynamic &quot;secret&quot; {
│ 
│ Blocks of type &quot;secret&quot; are not expected here.
</code></pre>
<p>How to use expression to create <code>env_from</code> only when object has <code>secrets</code> variable?</p>

nicram
<p>I've found solution</p>
<pre class="lang-tf prettyprint-override"><code>...
      dynamic &quot;env_from&quot; {
        for_each = each.value.secrets[*]
        content {
          secret_ref {
            name = kubernetes_secret.secret[each.value.name].metadata[0].name
          }
        }
      }
...
</code></pre>
<p>and seems to work. More details can be found in the Terraform docs on <a href="https://developer.hashicorp.com/terraform/language/expressions/dynamic-blocks" rel="nofollow noreferrer">dynamic blocks</a>.</p>
