diff --git a/.changelog/2084.txt b/.changelog/2084.txt
new file mode 100644
index 0000000000..0c23381e47
--- /dev/null
+++ b/.changelog/2084.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+`kubernetes/provider.go`: add `conflictsWith` to provider schema
+```
diff --git a/kubernetes/provider.go b/kubernetes/provider.go
index 2bd548b062..88bc7faaa6 100644
--- a/kubernetes/provider.go
+++ b/kubernetes/provider.go
@@ -40,46 +40,57 @@ func Provider() *schema.Provider {
 	p := &schema.Provider{
 		Schema: map[string]*schema.Schema{
 			"host": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_HOST", ""),
-				Description: "The hostname (in form of URI) of Kubernetes master.",
+				Type:          schema.TypeString,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_HOST", nil),
+				Description:   "The hostname (in form of URI) of Kubernetes master.",
+				ConflictsWith: []string{"config_path", "config_paths"},
 			},
 			"username": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_USER", ""),
-				Description: "The username to use for HTTP basic authentication when accessing the Kubernetes master endpoint.",
+				Type:          schema.TypeString,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_USER", nil),
+				Description:   "The username to use for HTTP basic authentication when accessing the Kubernetes master endpoint.",
+				ConflictsWith: []string{"config_path", "config_paths", "exec", "token", "client_certificate", "client_key"},
+				RequiredWith:  []string{"password", "host"},
 			},
 			"password": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_PASSWORD", ""),
-				Description: "The password to use for HTTP basic authentication when accessing the Kubernetes master endpoint.",
+				Type:          schema.TypeString,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_PASSWORD", nil),
+				Description:   "The password to use for HTTP basic authentication when accessing the Kubernetes master endpoint.",
+				ConflictsWith: []string{"config_path", "config_paths", "exec", "token", "client_certificate", "client_key"},
+				RequiredWith:  []string{"username", "host"},
 			},
 			"insecure": {
-				Type:        schema.TypeBool,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_INSECURE", false),
-				Description: "Whether server should be accessed without verifying the TLS certificate.",
+				Type:          schema.TypeBool,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_INSECURE", nil),
+				Description:   "Whether server should be accessed without verifying the TLS certificate.",
+				ConflictsWith: []string{"cluster_ca_certificate"},
 			},
 			"client_certificate": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_CLIENT_CERT_DATA", ""),
-				Description: "PEM-encoded client certificate for TLS authentication.",
+				Type:          schema.TypeString,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_CLIENT_CERT_DATA", nil),
+				Description:   "PEM-encoded client certificate for TLS authentication.",
+				ConflictsWith: []string{"config_path", "config_paths", "username", "password"},
+				RequiredWith:  []string{"client_key"},
 			},
 			"client_key": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_CLIENT_KEY_DATA", ""),
-				Description: "PEM-encoded client certificate key for TLS authentication.",
+				Type:          schema.TypeString,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_CLIENT_KEY_DATA", nil),
+				Description:   "PEM-encoded client certificate key for TLS authentication.",
+				ConflictsWith: []string{"config_path", "config_paths", "username", "password", "exec"},
+				RequiredWith:  []string{"client_certificate"},
 			},
 			"cluster_ca_certificate": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("KUBE_CLUSTER_CA_CERT_DATA", ""),
-				Description: "PEM-encoded root certificates bundle for TLS authentication.",
+				Type:          schema.TypeString,
+				Optional:      true,
+				DefaultFunc:   schema.EnvDefaultFunc("KUBE_CLUSTER_CA_CERT_DATA", nil),
+				Description:   "PEM-encoded root certificates bundle for TLS authentication.",
+				ConflictsWith: []string{"insecure"},
 			},
 			"config_paths": {
 				Type:        schema.TypeList,