Terraform-provider-kubernetes: Need mechanism for mutating annotations & labels on system namespaces

[chris-codaio]

A basic use case is needing to annotation the kube-system namespace for KIAM.

terraform import doesn't work for well documented reasons around non-variable references (i.e., module output variables and locals) in modules.

From an aborted PR attempt (https://github.com/terraform-providers/terraform-provider-kubernetes/pull/236), some ideas are:

• Take inspiration from the AWS plugin around aws_default_vpc, aws_default_subnet, etc. and create a kubernetes_system_namespace resource that takes control of the existing resource.
• Create a kubernetes_namespace_metadata resource that just manages the metadata for an existing namespace.
• Create more specific metadata resources like kubernetes_namespace_metadata_annotations and kubernetes_namespace_metadata_labels

[chris-codaio]

• @pdecat @alexsomesan

[Aaron-ML]

@chrisleck Anything ever come from this? Trying to implement istio labels on the default namespace and I'm not able to use it with the kubernetes_namespace resource.

[pdecat]

Hi,

I'd vote for generic kubernetes_metadata_annotations and kubernetes_metadata_labels resources to also address potential other use cases, if not too complex to implement.
Otherwise kubernetes_namespace_metadata_annotations
and kubernetes_namespace_metadata_labels to specifically address this PR's use case.

@Aaron-ML current work-around is to import the system namespaces, cf. https://github.com/terraform-providers/terraform-provider-kubernetes/pull/236#issuecomment-443143450 and https://github.com/terraform-providers/terraform-provider-kubernetes/pull/236#issuecomment-443264219

[Aaron-ML]

@pdecat That would work for me.

Regarding your work-around, you manually import the pre-existing namespaces on each run?

[pdecat]

I only import system namespaces on the first run, after cluster creation.

[msvechla]

Also looking for a way to manipulate system namespaces, e.g. default.
Unfortunately importing the namespace to terraform is not a trivial task to automate with terraform, therefor having resources as suggested in the initial report would be a great addition.

I like the approach of following the aws solution like aws_default_vpc.

[dak1n1]

Aggregated attributes would improve the import process. Needs further investigation.

We should check the aws_default_vpc and other aws_default_* resources for an example of how to implement this. Thanks for the suggestion, @msvechla!

[dak1n1]

This is finally making it into our work queue. We're tracking this issue in https://github.com/hashicorp/terraform-provider-kubernetes/issues/692. I'll close this one as a duplicate.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!