Kubectl manifest can't find api resource eventhough it exist

[paldab]

I am trying to create components of the external-secrets.io/v1beta1 api. The resource get's created with success but after this, it returns an error which says Error: gcp-backend failed to fetch resource from kubernetes: the server could not find the requested resource

This error happens with everything from this resource. I am assuming it has something to do with the v1beta1 but I don't know why that would be an issue. This api resource does not yet has a released v1 api. I am running Terraform version 1.5.6

This is my required providers settings

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "4.74.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "2.22.0"
    }
    kubectl = {
      source  = "gavinbunney/kubectl"
      version = "1.14.0"
    }
  }
}

# provider
provider "kubernetes" {
  host                   = "https://${data.terraform_remote_state.infrastructure.outputs.cluster_auth.endpoint}"
  client_certificate     = data.terraform_remote_state.infrastructure.outputs.cluster_auth.client_certificate
  client_key             = data.terraform_remote_state.infrastructure.outputs.cluster_auth.client_key
  cluster_ca_certificate = data.terraform_remote_state.infrastructure.outputs.cluster_auth.ca_certificate
  token                  = data.google_client_config.default.access_token
}

provider "kubectl" {
  host                   = "https://${data.terraform_remote_state.infrastructure.outputs.cluster_auth.endpoint}"
  client_certificate     = data.terraform_remote_state.infrastructure.outputs.cluster_auth.client_certificate
  client_key             = data.terraform_remote_state.infrastructure.outputs.cluster_auth.client_key
  cluster_ca_certificate = data.terraform_remote_state.infrastructure.outputs.cluster_auth.ca_certificate
  token                  = data.google_client_config.default.access_token
}

This is my terraform code

resource "k8s_external_secrets_io_cluster_secret_store_v1beta1" "cluster-secret-store" {
  metadata = {
    name = "gcp-backend"
  }

  spec = {
    provider = {
      gcpsm = {
        project_id = var.project
        auth = {
          workload_identity = {
            cluster_name     = var.cluster_name
            cluster_location = var.cluster_location
            service_account_ref = {
              name      = local.kubernetes_service_account_name
              namespace = local.namespace
            }
          }
        }
      }
    }
  }
}

# SecretClusterStore to authenticate the retrieval of secrets
resource "kubectl_manifest" "css-manifest" {
  yaml_body = k8s_external_secrets_io_cluster_secret_store_v1beta1.cluster-secret-store.yaml
}

The Api resources in my cluster include the following

clusterexternalsecrets            ces                     external-secrets.io/v1beta1               false        ClusterExternalSecret
clustersecretstores               css                     external-secrets.io/v1beta1               false        ClusterSecretStore
externalsecrets                   es                      external-secrets.io/v1beta1               true         ExternalSecret
pushsecrets                                               external-secrets.io/v1alpha1              true         PushSecret
secretstores                      ss                      external-secrets.io/v1beta1               true         SecretStore

Again, the resource gets created and everything works fine but my terraform code returns an error and does not save the resource in the state, resulting that it tries to recreate it with every run.

[paldab]

I took a small deep dive in the code of the manifest but I am not very familiar with go so I have a limited understanding of it. I have to mention that the ClusterSecretStore kind is a kind with not namespace attached to it. It is accessible from everywhere. I am not sure how kubernetes handles this but could this be the problem of the error?

[clayrisser]

I just faced this issue too. It creates the resource but then says it can't find it. This didn't used to happen.

[clayrisser]

Seems to be the same problem as #270

[theunwisewolf]

Can confirm this is a legit issue.
This was not happening in older versions.

[alekc]

Can you try the fork

terraform {
  required_version = ">= 0.13"

  required_providers {
    kubectl = {
      source  = "alekc/kubectl"
      version = ">= 2.0.2"
    }
  }

That issue should be fixed there

[clay-risser]

Thanks

[scrooloose]

@alekc thanks. I was ready to cry, but your fork spared my dignity :-D

[HenrikS-AteaSE]

@alekc Any chance of getting this fork merged, since it obviously works?

[alekc]

Merged where sorry? This repo is abandoned, I am maintaining a fork (with big fixes and new features) on https://github.com/alekc/terraform-provider-kubectl

…

On Mon, 2 Sept 2024, 14:02 Henrik Svensson, ***@***.***> wrote: @alekc <https://github.com/alekc> Any chance of getting this fork merged, since it obviously works? — Reply to this email directly, view it on GitHub <#274 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACJ5VZ33YAR5KLQZMYUFPTZUROXPAVCNFSM6AAAAABNQJP2KOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMRUG4YTCNZQGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[HenrikS-AteaSE]

Ah, my bad! I'm loving the changes you've made but when I first searched the providers on TF registry I only saw this old one. Today I saw yours in on there as well. I just wanted people to have a chance at finding the working version from the start and not like me where I first had issues with the old until I found this issue.
But I see I was just temporarily blind :)