Terraform import failing because Kubernetes provider relies on data sources - terraform

Question

Using Terraform, I'm creating a Kubernetes cluster, installing the nginx-ingress-controller Helm chart, and then adding a Route53 hosted zone for my domain (including a wildcard record pointing to the load balancer created by the ingress Helm chart.
To do this I use two separate Terraform files and my process should be as follows -
Use Terraform file 1 to apply a VPC, EKS cluster and node group.
Use the Helm CLI to install the nginx-ingress-controller chart (there is an additional requirement not related to this issue that means the Helm chart cannot be installed by Terraform).
Import the namespace to which the nginx-ingress-controller chart was deployed into the state for Terraform file 2
Use Terraform file 2 to apply the Route53 hosted zone and record required for ingress.
I thought this was going to work, but the Terraform import command has a severe limitation -
The only limitation Terraform has when reading the configuration files is that the import provider configurations must not depend on non-variable inputs. For example, a provider configuration cannot depend on a data source.
Because I'm using a Kubernetes provider that relies on data sources, I'm falling foul of this limitation.
data "aws_eks_cluster" "cluster" {
name = var.cluster.name
}
data "aws_eks_cluster_auth" "cluster" {
name = var.cluster.name
}
provider "kubernetes" {
host = data.aws_eks_cluster.cluster.endpoint
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
token = data.aws_eks_cluster_auth.cluster.token
}
Taking the following in to account, is there a way of using Terraform that would work?
I need to output the value of the NS record for the Route53 hosted zone created by the apply of Terraform file 2. Because of this, I can't include those resources in Terraform file 1 as the apply would fail if an output exists for a module/resource that won't yet exist.
The namespace must be imported so that it is destroyed when destroy is run for Terraform file 2. If it is not, when destroy is run for Terraform file 1 it will fail because the VPC won't be able to delete due to the network interface and security group created by the nginx-ingress-controller Helm chart.
The token provided by the aws_eks_cluster_auth data source only lasts for 15 minutes (the aws-iam-authenticator cannot provide a longer token), so it is inappropriate to output the token from Terraform file 1 because it's likely to have expired by the time it is used by Terraform file 2.
Update
I've tried to use an exec-based credential plugin as that means no data source would be required, but this causes Terraform to fail right out of the gate. It seems that in this case Terraform tries to create a config file before module.kubernetes-cluster has been created, so the cluster doesn't exist.
This provider configuration -
provider "kubernetes" {
host = module.kubernetes-cluster.endpoint
insecure = true
exec {
api_version = "client.authentication.k8s.io/v1alpha1"
args = ["eks", "get-token", "--region", var.cluster.region, "--cluster-name", var.cluster.name]
command = "aws"
}
}
Produces this error -
╷
│ Error: Provider configuration: cannot load Kubernetes client config
│
│ with provider["registry.terraform.io/hashicorp/kubernetes"],
│ on main.tf line 73, in provider "kubernetes":
│ 73: provider "kubernetes" {
│
│ invalid configuration: default cluster has no server defined
╵

Answer 1

I got this error when updating my google_container_cluster in GKE with a new network configuration. To resolve it, I had to revert to the older network configuration, remove the provider "kubernetes", add the new network configuration and then add provider "kubernetes" back.