### Example Usage of kubectl_filename_list

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_filename_list.md

Demonstrates how to use the kubectl_filename_list data source to find YAML files and then apply them using the kubectl_manifest resource.

```hcl
data "kubectl_filename_list" "manifests" {
    pattern = "./manifests/*.yaml"
}

resource "kubectl_manifest" "test" {
    count     = length(data.kubectl_filename_list.manifests.matches)
    yaml_body = file(element(data.kubectl_filename_list.manifests.matches, count.index))
}
```

--------------------------------

### Example Template with Looping Directive

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_path_documents.md

Illustrates using a directive with `split` to generate multiple manifests, such as creating a PersistentVolumeClaim for each namespace in a comma-separated list.

```yaml
#
# Given the following YAML template
#
%{ for namespace in split(",", namespaces) }
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: myvolume-claim
  namespace: ${namespace}
spec:
  accessModes:
    - ReadWriteMany
  volumeMode: Filesystem
  resources:
    requests:
      storage: 100Gi
%{ endfor }

```

```hcl
#
# Loading the document is a comma-separated list of namespace
#
data "kubectl_path_documents" "manifests" {
    pattern = "./manifests/*.yaml"
    vars = {
        namespaces = "dev,test,prod"
    }
}

#
# Results in 3 documents:
#
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: myvolume-claim
  namespace: dev
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: myvolume-claim
  namespace: test
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: myvolume-claim
  namespace: prod

```

--------------------------------

### Example Template with Variable Substitution

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_path_documents.md

Demonstrates loading a YAML file and parsing a variable like `${docker_image}` using the `vars` attribute for template rendering.

```yaml
#
# Given the following YAML template
#
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    name: nginx
spec:
  containers:
  - name: nginx
    image: ${docker_image}
    ports:
    - containerPort: 80

```

```hcl
#
# Load the yaml file, parsing the ${docker_image} variable
#
data "kubectl_path_documents" "manifests" {
    pattern = "./manifests/*.yaml"
    vars = {
        docker_image = "https://myregistry.example.com/nginx"
    }
}
```

--------------------------------

### Kubectl Manifest Resource Example

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Define a Kubernetes resource using the kubectl_manifest resource. The yaml_body accepts a YAML string for resource definition.

```hcl
resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: couchbase.com/v1
kind: CouchbaseCluster
metadata:
  name: name-here-cluster
spec:
  baseImage: name-here-image
  version: name-here-image-version
  authSecret: name-here-operator-secret-name
  exposeAdminConsole: true
  adminConsoleServices:
    - data
  cluster:
    dataServiceMemoryQuota: 256
    indexServiceMemoryQuota: 256
    searchServiceMemoryQuota: 256
    eventingServiceMemoryQuota: 256
    analyticsServiceMemoryQuota: 1024
    indexStorageSetting: memory_optimized
    autoFailoverTimeout: 120
    autoFailoverMaxCount: 3
    autoFailoverOnDataDiskIssues: true
    autoFailoverOnDataDiskIssuesTimePeriod: 120
    autoFailoverServerGroup: false
YAML
}
```

--------------------------------

### Example Template with Conditional Directives

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_path_documents.md

Shows how templates can support directives for conditional logic, such as using an `if` statement to determine the container image based on a variable.

```yaml
#
# Given the following YAML template
#
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    name: nginx
spec:
  containers:
  - name: nginx
    image: %{ if docker_image != "" }${docker_image}%{ else }default-nginx%{ endif }
    ports:
    - containerPort: 80

```

```hcl
#
# Load the yaml file, parsing the ${docker_registry} variable, resulting in `default-nginx`
#
data "kubectl_path_documents" "manifests" {
    pattern = "./manifests/*.yaml"
    vars = {
        docker_image = ""
    }
}
```

--------------------------------

### Example Usage via count

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_file_documents.md

Access raw documents via the `documents` attribute using a `count` expression. This is an alternative to using `for_each`.

```hcl
data "kubectl_file_documents" "docs" {
    content = file("multi-doc-manifest.yaml")
}

resource "kubectl_manifest" "test" {
    count     = length(data.kubectl_file_documents.docs.documents)
    yaml_body = element(data.kubectl_file_documents.docs.documents, count.index)
}
```

--------------------------------

### Pod Creation with Explicit Wait Conditions

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/resources/kubectl_manifest.md

This example shows creating a Kubernetes Pod with explicit `wait_for` conditions, including field checks (with regex) and condition status checks. The provider will wait for all specified conditions to be met before considering the resource applied.

```hcl
resource "kubectl_manifest" "test" {
  wait_for {
    field {
      key = "status.containerStatuses.[0].ready"
      value = "true"
    }
    field {
      key = "status.phase"
      value = "Running"
    }
    field {
      key = "status.podIP"
      value = "^(\\d+(\\.|$)){4}"
      value_type = "regex"
    }
    condition {
      type = "ContainersReady"
      status = "True"
    }
    condition {
      type = "Ready"
      status = "True"
    }
  }
  yaml_body = <<YAML
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: registry.k8s.io/e2e-test-images/nginx:1.28.0-1
    readinessProbe:
      httpGet:
        path: "/"
        port: 80
      initialDelaySeconds: 10
YAML
}
```

--------------------------------

### Kubectl Provider Configuration Example

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/index.md

Configures the kubectl provider with connection details for an EKS cluster. It demonstrates setting the host, CA certificate, token, and disabling loading of the default config file.

```hcl
provider "kubectl" {
  host                   = var.eks_cluster_endpoint
  cluster_ca_certificate = base64decode(var.eks_cluster_ca)
  token                  = data.aws_eks_cluster_auth.main.token
  load_config_file       = false
}
```

--------------------------------

### Terraform Plan Output After Migration

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

This is an example of the Terraform plan output after applying the initial `moved` block for state migration. It indicates that the resource has moved without any changes to the resource itself.

```text
# kubectl_manifest.my_app has moved to kubectl_manifest.my_app_v3
    resource "kubectl_manifest" "my_app_v3" {
        # (N unchanged attributes hidden)
    }
Plan: 0 to add, 0 to change, 0 to destroy.
```

--------------------------------

### Example Usage with for_each

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_file_documents.md

Use the `manifests` attribute with a `for_each` expression to apply found manifests. This approach minimizes Terraform changes when YAML documents are added or removed.

```hcl
data "kubectl_file_documents" "docs" {
    content = file("multi-doc-manifest.yaml")
}

resource "kubectl_manifest" "test" {
    for_each  = data.kubectl_file_documents.docs.manifests
    yaml_body = each.value
}
```

--------------------------------

### Terraform Provider Configuration (0.13+)

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/index.md

Specifies the required Terraform version and the kubectl provider source and version. This is used for automatic installation by Terraform.

```hcl
terraform {
  required_version = ">= 0.13"

  required_providers {
    kubectl = {
      source  = "alekc/kubectl"
      version = ">= 2.0.0"
    }
  }
}
```

--------------------------------

### Obfuscate Sensitive Fields in a MutatingWebhookConfiguration

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/templates/index.md

This example shows how to use the `sensitive_fields` argument to obfuscate specific sensitive data within a Kubernetes `MutatingWebhookConfiguration` manifest. It targets a custom annotation for obfuscation.

```hcl
resource "kubectl_manifest" "test" {
    sensitive_fields = [
        "metadata.annotations.my-secret-annotation"
    ]

    yaml_body = <<YAML
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
  annotations:
    my-secret-annotation: "this is very secret"
webhooks:
  - clientConfig:
      caBundle: ""
YAML
}
```

--------------------------------

### Get Current Kubernetes Server Version

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_server_version.md

Use this snippet to fetch the current Kubernetes server version information. This data can be used to conditionally configure other resources.

```hcl
data "kubectl_server_version" "current" { }

```

--------------------------------

### Build the provider from source

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Clone the repository and use 'make build' to compile the provider. The binary is placed in $(go env GOPATH)/bin/terraform-provider-kubectl.

```sh
git clone https://github.com/alekc/terraform-provider-kubectl
cd terraform-provider-kubectl
make build
```

--------------------------------

### Build a specific version for local testing

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Checkout the desired branch or commit, then build the provider. This is useful for testing fixes before a release.

```sh
git clone https://github.com/alekc/terraform-provider-kubectl
cd terraform-provider-kubectl
git checkout master           # or any branch / tag / commit
make build                    # binary at $(go env GOPATH)/bin/terraform-provider-kubectl
```

--------------------------------

### Replace kubectl Provider in OpenTofu State

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Use this command to replace the gavinbunney/kubectl provider with alekc/kubectl in your OpenTofu state. Run `tofu init` afterwards. The first `tofu plan` will show additions for alekc-only attributes; a subsequent `tofu apply` will absorb them.

```sh
tofu state replace-provider gavinbunney/kubectl alekc/kubectl
tofu init
```

--------------------------------

### Run unit tests

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Execute 'make test' to run unit tests for the provider's Go packages. This does not require a Kubernetes cluster and includes race detection and coverage.

```sh
make test       # unit
```

--------------------------------

### Run acceptance tests

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Execute 'make testacc' to run acceptance tests against a live Kubernetes cluster. Ensure KUBE_CONFIG_PATH or KUBECONFIG is set.

```sh
make testacc    # acceptance, needs a cluster + KUBE_CONFIG_PATH
```

--------------------------------

### Create a Kubernetes Ingress Resource

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/templates/index.md

This snippet demonstrates how to create a Kubernetes Ingress resource using the `kubectl_manifest` resource with a raw YAML body. It defines the Ingress configuration including metadata and spec.

```hcl
resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    azure/frontdoor: enabled
spec:
  rules:
  - http:
      paths:
      - path: /testpath
        pathType: "Prefix"
        backend:
          serviceName: test
          servicePort: 80
YAML
}
```

--------------------------------

### Enable Lazy Loading for Kubectl Provider Configuration

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/index.md

Use `lazy_load = true` to opt into pre-v2.3.0 behavior where client configuration errors are deferred until the first use. This can be a workaround for deferred evaluation issues but may result in less specific error messages.

```hcl
provider "kubectl" {
  host                   = module.eks.cluster_endpoint
  cluster_ca_certificate = base64decode(module.eks.cluster_ca_certificate)
  token                  = data.aws_eks_cluster_auth.this.token
  load_config_file       = false
  lazy_load              = true
}
```

--------------------------------

### Replace kubectl Provider in Terraform State

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Use this command to replace the gavinbunney/kubectl provider with alekc/kubectl in your Terraform state. Run `terraform init` afterwards. The first `terraform plan` will show additions for alekc-only attributes; a subsequent `terraform apply` will absorb them.

```sh
terraform state replace-provider gavinbunney/kubectl alekc/kubectl
```

--------------------------------

### Load Manifests from Directory using for_each

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_path_documents.md

Recommended approach for loading all manifest documents from a folder using the `manifests` attribute and a `for_each` expression. This method minimizes Terraform changes when the manifest set is updated.

```hcl
data "kubectl_path_documents" "manifests-directory-yaml" {
  pattern = "./manifests/*.yaml"
}

resource "kubectl_manifest" "directory-yaml" {
  for_each  = data.kubectl_path_documents.manifests-directory-yaml.manifests
  yaml_body = each.value
}
```

--------------------------------

### Basic kubectl_server_version Resource Usage

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/resources/kubectl_server_version.md

Use this snippet to declare a kubectl_server_version resource. No arguments are required for basic usage.

```hcl
resource "kubectl_server_version" "current" { }
```

--------------------------------

### Run specific acceptance tests

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Pass arguments to 'make testacc' using ACC_TESTARGS to filter or configure test runs, such as targeting a specific test case.

```sh
ACC_TESTARGS="-parallel 4 -run TestAccKubectlDataSourceManifest" make testacc
```

--------------------------------

### Configuring Timeouts for Resource Operations

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/resources/kubectl_manifest.md

Sets custom timeouts for create, update, and delete operations, overriding the default 10 minutes. Useful for workloads with long rollout times.

```hcl
resource "kubectl_manifest" "my_deployment" {
  timeouts {
    create = "30m"
    update = "30m"
    delete = "5m"
  }

  yaml_body = <<YAML
apiVersion: apps/v1
kind: Deployment
# ...
YAML
}
```

--------------------------------

### Configure Terraform development overrides

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Edit ~/.terraformrc to point Terraform to your local provider binary directory. This allows testing unreleased versions.

```hcl
provider_installation {
  dev_overrides {
    "alekc/kubectl" = "/path/to/your/gopath/bin"
  }
  direct {}
}
```

--------------------------------

### Loading a Raw YAML Manifest

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/index.md

Use the `kubectl_manifest` resource to load a raw YAML manifest into Kubernetes. Set the `yaml_body` argument with your manifest content. Updates to the manifest are preserved.

```hcl
provider "kubectl" {
  host                   = var.eks_cluster_endpoint
  cluster_ca_certificate = base64decode(var.eks_cluster_ca)
  token                  = data.aws_eks_cluster_auth.main.token
  load_config_file       = false
}

resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: couchbase.com/v1
kind: CouchbaseCluster
metadata:
  name: name-here-cluster
spec:
  baseImage: name-here-image
  version: name-here-image-version
  authSecret: name-here-operator-secret-name
  exposeAdminConsole: true
  adminConsoleServices:
    - data
  cluster:
    dataServiceMemoryQuota: 256
    indexServiceMemoryQuota: 256
    searchServiceMemoryQuota: 256
    eventingServiceMemoryQuota: 256
    analyticsServiceMemoryQuota: 1024
    indexStorageSetting: memory_optimized
    autoFailoverTimeout: 120
    autoFailoverMaxCount: 3
    autoFailoverOnDataDiskIssues: true
    autoFailoverOnDataDiskIssuesTimePeriod: 120
    autoFailoverServerGroup: false
YAML
}
```

--------------------------------

### Load Manifests using count

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_path_documents.md

Loads all manifest documents via the `documents` attribute using a `count` expression. Be aware that changes to the document order, such as adding a new file, can trigger destruction and recreation of related documents.

```hcl
data "kubectl_path_documents" "docs" {
    pattern = "./manifests/*.yaml"
}

resource "kubectl_manifest" "test" {
    count     = length(data.kubectl_path_documents.docs.documents)
    yaml_body = element(data.kubectl_path_documents.docs.documents, count.index)
}
```

--------------------------------

### Importing a Namespace Resource

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/templates/index.md

Import an existing Kubernetes Namespace resource into Terraform state. The ID format requires the API version, kind, and name, separated by double forward slashes.

```bash
# Import the my-namespace Namespace
terraform import kubectl_manifest.my-namespace v1//Namespace//my-namespace
```

--------------------------------

### Migrate kubectl_manifest from gavinbunney/kubectl to alekc/kubectl

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

This HCL configuration demonstrates migrating state for `kubectl_manifest` resources from the `gavinbunney/kubectl` provider to `alekc/kubectl` using a `moved` block. It requires Terraform 1.8+ and involves a rename-and-rename-back pattern for state management.

```hcl
terraform {
  required_providers {
    kubectl = {
      source = "alekc/kubectl"
    }
  }
}

moved {
  from = kubectl_manifest.my_app          # was gavinbunney/kubectl
  to   = kubectl_manifest.my_app_v3       # now alekc/kubectl
}

resource "kubectl_manifest" "my_app_v3" {
  # ... same yaml_body / attributes as before
}
```

--------------------------------

### Kubectl Provider Configuration with Exec Plugin

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/index.md

This snippet demonstrates how to configure the Kubectl provider to use an exec-based credential plugin, such as the aws-iam-authenticator for EKS clusters. It shows setting retry counts, host, CA certificate, and disabling local config file loading, along with the exec plugin's command, arguments, and API version.

```hcl
provider "kubectl" {
  apply_retry_count      = 15
  host                   = var.eks_cluster_endpoint
  cluster_ca_certificate = base64decode(var.eks_cluster_ca)
  load_config_file       = false

  exec {
    api_version = "client.authentication.k8s.io/v1alpha1"
    command     = "aws-iam-authenticator"
    args = [
      "token",
      "-i",
      module.eks.cluster_id,
    ]
  }
}
```

--------------------------------

### Read a ConfigMap Value

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_manifest.md

Fetches a ConfigMap and extracts the 'ca.crt' content into a variable named 'ca'. The extracted value is then outputted.

```hcl
data "kubectl_manifest" "ca" {
  api_version = "v1"
  kind        = "ConfigMap"
  name        = "kube-root-ca.crt"
  namespace   = "kube-system"

  fields = {
    ca = "data.ca\\.crt"
  }
}

output "ca_bundle" {
  value = data.kubectl_manifest.ca.results["ca"]
}
```

--------------------------------

### Importing a Custom Resource Definition (CRD)

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/templates/index.md

Import a Custom Resource Definition (CRD) from a specific namespace. The import ID includes API group, version, kind, name, and namespace, using double forward slashes as delimiters.

```bash
# Import the certmanager Issuer CRD named cluster-selfsigned-issuer-root-ca from the my-namespace namespace
$ terraform import -provider kubectl module.kubernetes.kubectl_manifest.crd-example certmanager.k8s.io/v1alpha1//Issuer//cluster-selfsigned-issuer-root-ca//my-namespace
```

--------------------------------

### Terraform Provider Configuration

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Configure the kubectl provider in your Terraform project. Ensure your Terraform version is compatible.

```hcl
terraform {
  required_version = ">= 1.0"

  required_providers {
    kubectl = {
      source  = "alekc/kubectl"
      version = "~> 2.3"
    }
  }
}
```

--------------------------------

### Verify cluster invariants during plan

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/ephemeral-resources/kubectl_manifest.md

This snippet demonstrates how to use an ephemeral resource within a Terraform check block to assert live cluster state, such as the presence of a CA ConfigMap, without persisting any data.

```hcl
ephemeral "kubectl_manifest" "ca" {
  api_version = "v1"
  kind        = "ConfigMap"
  name        = "kube-root-ca.crt"
  namespace   = "kube-system"
}

check "ca_present" {
  assert {
    condition     = length(ephemeral.kubectl_manifest.ca.yaml) > 0
    error_message = "cluster CA ConfigMap is missing from kube-system"
  }
}
```

--------------------------------

### Read a Cluster-Scoped Object

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_manifest.md

Fetches a cluster-scoped object like a Namespace. The 'namespace' argument is omitted for such resources.

```hcl
data "kubectl_manifest" "ns" {
  api_version = "v1"
  kind        = "Namespace"
  name        = "kube-system"

  fields = {
    phase = "status.phase"
  }
}
```

--------------------------------

### Importing a Kubectl Manifest CRD

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/resources/kubectl_manifest.md

Import an existing cert-manager Issuer CRD into Terraform state. Ensure the provider and resource configuration are correctly set up before running the import command.

```bash
$ terraform import -provider kubectl module.kubernetes.kubectl_manifest.crd-example certmanager.k8s.io/v1alpha1//Issuer//cluster-selfsigned-issuer-root-ca//my-namespace
```

--------------------------------

### Read a CRD Object and Extract Nested Array Elements

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_manifest.md

Fetches a Deployment object and extracts specific fields, including an element from a nested array and metadata labels. The labels are JSON-decoded for use.

```hcl
data "kubectl_manifest" "dep" {
  api_version = "apps/v1"
  kind        = "Deployment"
  name        = "nginx"
  namespace   = "web"

  fields = {
    replicas        = "spec.replicas"
    first_image     = "spec.template.spec.containers.[0].image"
    labels          = "metadata.labels"
  }
}

# `labels` is a JSON-encoded object string. `jsondecode()` recovers it.
output "labels" {
  value = jsondecode(data.kubectl_manifest.dep.results["labels"])
}
```

--------------------------------

### Ignoring Fields During Manifest Changes

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/resources/kubectl_manifest.md

Configures a list of YAML keys to ignore changes for, useful for fields managed by external processes. Supports dot-separator syntax for nested fields and indexed access for arrays.

```hcl
resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: v1
kind: ServiceAccount
metadata:
  name: name-here
  namespace: default
  annotations:
    this.should.be.ignored: "true"
YAML

    ignore_fields = ["metadata.annotations"]
}
```

```hcl
resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - clientConfig:
      caBundle: ""
YAML

    ignore_fields = ["webhooks.0.clientConfig.caBundle"]
}
```

--------------------------------

### Read Kubernetes Object with kubectl_manifest

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Use the `kubectl_manifest` data source to read cluster objects by apiVersion, kind, and name. It extracts user-named fields and exposes raw YAML/JSON. This is suitable for non-sensitive data cached in state.

```hcl
data "kubectl_manifest" "ns" {
  api_version = "v1"
  kind        = "Namespace"
  name        = "kube-system"
  fields = {
    phase = "status.phase"
  }
}
```

--------------------------------

### Consuming Ephemeral Data with Local File Resource

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Consume ephemeral data using a write-only attribute (content_wo) in Terraform 1.11+. The data is written to a file and not persisted in state.

```hcl
# Example consumer: stage the password into a sibling tool's config
# during apply, never to state. `content_wo` is a write-only attribute
# (Terraform 1.11+); the value is forgotten after the file is written.
resource "local_file" "db_password" {
  filename            = "${path.module}/.db-password"
  content_wo          = ephemeral.kubectl_manifest.db_creds.results["password"]
  content_wo_revision = 1
}
```

--------------------------------

### Terraform required_providers block

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

Keep the required_providers block in your Terraform configuration pointing to the official source. Terraform will use the local build due to dev_overrides.

```hcl
terraform {
  required_providers {
    kubectl = {
      source  = "alekc/kubectl"
      version = ">= 2.0.0"
    }
  }
}
```

--------------------------------

### Terraform override warning message

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/CONTRIBUTING.md

This warning message indicates that your custom local build is being used by Terraform. It is expected and cannot be suppressed.

```text
│ Warning: Provider development overrides are in effect
│
│ The following provider development overrides are set in the CLI
│ configuration:
│  - alekc/kubectl in /path/to/your/gopath/bin
```

--------------------------------

### Ephemeral Kubectl Manifest for Sensitive Data

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/README.md

Use ephemeral kubectl_manifest for sensitive data like passwords that should not be stored in Terraform state. Requires Terraform 1.10+.

```hcl
ephemeral "kubectl_manifest" "db_creds" {
  api_version = "v1"
  kind        = "Secret"
  name        = "postgres-credentials"
  namespace   = "data"

  fields = {
    password = "data.password"
  }
}
```

--------------------------------

### Ignore Specific Array Element Field in Kubectl Manifest

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/templates/index.md

Configure `ignore_fields` to target and ignore specific fields within an array element, such as `caBundle` in a webhook configuration. The syntax uses zero-based indexing for array elements.

```hcl
resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - clientConfig:
      caBundle: ""
YAML

    ignore_fields = ["webhooks.0.clientConfig.caBundle"]
}
```

--------------------------------

### Configure Retry Count for Kubectl Provider

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/index.md

Set the `apply_retry_count` parameter in the provider block to specify the number of retries for Kubernetes apply operations. This is useful for handling flaky CRDs or network issues.

```hcl
provider "kubectl" {
  apply_retry_count = 15
}
```

--------------------------------

### Reading Sensitive Data from a Secret

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/data-sources/kubectl_manifest.md

Fetches sensitive data (TLS certificate and key) from a Kubernetes Secret. The output is explicitly marked as sensitive to prevent exposure in Terraform state and CLI output.

```hcl
data "kubectl_manifest" "tls" {
  api_version = "v1"
  kind        = "Secret"
  name        = "ingress-tls"
  namespace   = "default"

  fields = {
    crt = "data.tls\\.crt"
    key = "data.tls\\.key"
  }
}

# Opt-in: mark the output sensitive so it's redacted in plan/apply CLI output
# and downstream references inherit the marking.
output "tls_key" {
  value     = data.kubectl_manifest.tls.results["key"]
  sensitive = true
}

# Or inline at the reference site:
resource "some_other" "x" {
  cert = sensitive(data.kubectl_manifest.tls.results["crt"])
}
```

--------------------------------

### Ignore Metadata Annotations in Kubectl Manifest

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/templates/index.md

Use `ignore_fields` to prevent updates to specific metadata annotations within a Kubernetes manifest. This is useful when annotations are managed by external tools.

```hcl
resource "kubectl_manifest" "test" {
    yaml_body = <<YAML
apiVersion: v1
kind: ServiceAccount
metadata:
  name: name-here
  namespace: default
  annotations:
    this.should.be.ignored: "true"
YAML

    ignore_fields = ["metadata.annotations"]
}
```

--------------------------------

### Read a Secret without persisting it

Source: https://github.com/alekc/terraform-provider-kubectl/blob/master/docs/ephemeral-resources/kubectl_manifest.md

Use this snippet to read sensitive data like a database password from a Kubernetes Secret. The password is then consumed by a local_file resource without being stored in Terraform state.

```hcl
ephemeral "kubectl_manifest" "db_creds" {
  api_version = "v1"
  kind        = "Secret"
  name        = "postgres-credentials"
  namespace   = "data"

  fields = {
    password = "data.password"
  }
}

# Example consumer: write the secret to a local file during apply, never to state.
resource "local_file" "db_password" {
  filename            = "${path.module}/.db-password"
  content_wo          = ephemeral.kubectl_manifest.db_creds.results["password"]
  content_wo_revision = 1
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.