provider overrides provided token if running inside a pod

[mrferos]

Terraform Version

0.12.13

Affected Resource(s)

• kubernetes_config_map ( really it was anything that was using the provider )

Terraform Configuration Files

data "aws_eks_cluster_auth" "sentinel" {
  name = module.eks-sentinel.cluster_id
}

provider "kubernetes" {
  alias = "sentinel"
  host = data.aws_eks_cluster.sentinel.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.sentinel.certificate_authority.0.data)
  token = data.aws_eks_cluster_auth.sentinel.token
  load_config_file = false
  version = "1.10"
}

Debug Output

https://gist.github.com/mrferos/610ed1ccea8d0e2845966dd9291eff62

Panic Output

N/A

Expected Behavior

I would expect for the provided token to be used

Actual Behavior

Because this was running inside a kubernetes pod KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT were defined, the provided token was ignored and it picked up the service account token in the pod.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. Provide a token manually
2. Run terraform inside a k8s pod

Important Factoids

1. I am running this inside an EKS-managed cluster
2. k8s provider 1.10
3. terraform 1.12.13
4. I haven't tested this against 1.11 because the EKS module was broken against 1.11 some days ago.

My quick workout was just to prepend KUBERNETES_SERVICE_HOST="" KUBERNETES_SERVICE_PORT="" to terraform apply and terraform plan

References

N/A

[pdecat]

Hi, this is fixed since the v1.11.0 release. Get v1.11.1 though, it's better.

[pdecat]

See "Refactor client config initialization and fix in-cluster config" (#679) (#497)

[mrferos]

Hi, this is fixed since the v1.11.0 release. Get v1.11.1 though, it's better.

Ah, okay, will try. Thanks! Closing issue.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!