basicAuth errors with is forbidden: User "system:anonymous"

[raelga]

Terraform Version, Provider Version and Kubernetes Version

> terraform -v
Terraform v1.9.5
on darwin_arm64
+ provider registry.terraform.io/hashicorp/kubernetes v2.32.0
> kubectl version
Client Version: v1.29.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.12+0c3c368

Affected Resource(s)

kubernetes provider initialization

Terraform Configuration Files

locals {
  host     = "https://api.****443"
  username = "***"
  password = "*****"
}

terraform {
  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "2.32.0"
    }
  }
  required_version = ">= 0.13"
}

provider "kubernetes" {
  host     = local.host
  username = local.username
  password = local.password
}

resource "kubernetes_secret" "vault_aws_credentials" {
  metadata {
    name      = "test"
    namespace = "default"
  }
}

> tf output username
"kubeadmin"
> tf output password
"*******"
> tf output server
"https://api.****:443"

Debug Output

https://gist.github.com/raelga/6bcdd75dade012522159dd125dd435f7

Steps to Reproduce

1. terraform plan

Expected Behavior

Connects to the cluster with the provided credentials.

Actual Behavior

Tries to connect with the cluster using system:anonymous user:

╷
│ Error: secrets is forbidden: User "system:anonymous" cannot create resource "secrets" in API group "" in the namespace "default"
│ 
│   with kubernetes_secret.test,
│   on main.tf line 23, in resource "kubernetes_secret" "test":
│   23: resource "kubernetes_secret" "test" {
│ 
╵

[alexsomesan]

Which type of cluster are you working with? Self-hosted / cloud-managed? any specific managed variety (EKS, GKE, AKS, etc)?

[raelga]

AWS ROSA cluster, cloud-managed.

[alexsomesan]

Quick follow-up here - it seems that basic auth has been removed from the API server in the 1.19 release: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#no-really-you-must-read-this-before-you-upgrade

Can you elaborate on your intended use of it in a v1.28.12 and how would it still be available?