frostmoln_kubernetes_cluster_kubeconfig (Data Source)

Fetch the kubeconfig of a managed Kubernetes cluster, resolved by ID or name. Exactly one of id or name must be specified.

This is the credential half of reaching a cluster that Terraform did not create: a cluster provisioned in the portal or with fm can today be referenced only by a hardcoded UUID, so look it up by name. The non-secret attributes of the same cluster (endpoint, CIDRs, tier, the CA cert hash) live on frostmoln_kubernetes_cluster.

A name lookup that matches nothing — or more than one cluster — fails the read, and a soft-deleted cluster (the deleted row answers 200 with status deleted forever) is reported as ABSENT on both paths. The service refuses the kubeconfig read until the cluster is serviceable: an EMPTY kubeconfig on a 200 fails the read instead of rendering empty credential material — the cluster may simply not be serviceable yet.

API-key callers need the kubernetes:read scope.

Example Usage

# Resolve a managed Kubernetes cluster by NAME and fetch its kubeconfig —
# no hardcoded UUID (a portal- or `fm`-created cluster is otherwise reachable
# only by its id).
data "frostmoln_kubernetes_cluster_kubeconfig" "billing" {
  name = "billing-prod"
}

# The blob is SECRET material: it carries the cluster client's private key.
# It appears redacted in CLI output, but it still lands in Terraform state —
# protect that state like you would protect a kubeconfig file (the non-secret
# pairing, the CA cert hash, lives on frostmoln_kubernetes_cluster).

# Composition contract: hand the raw blob to a provider's kubeconfig input.
# No parsing of the client key/cert out of the YAML happens here — the raw
# string is the contract every kube client composes from. Commented rather
# than live so this example does not read like a state fixture holding fake
# credentials:
#
# provider "kubernetes" {
#   host = data.frostmoln_kubernetes_cluster_kubeconfig.billing.endpoint
#   # the kubernetes provider accepts the kubeconfig as raw YAML
# }
#
# provider "helm" {
#   # the helm provider takes the same raw blob
# }

# A cluster that matches nothing, an ambiguous name, or a soft-deleted cluster
# fails the read. So does an EMPTY kubeconfig on a 200: the cluster may not be
# serviceable yet, and empty credential material is never rendered silently.

Schema

Optional

• id (String) The unique identifier of the Kubernetes cluster. Exactly one of id or name must be specified. In state this is the RESOLVED cluster's id.
• name (String) The name of the Kubernetes cluster. Exactly one of id or name must be specified. In state this is the resolved cluster's verified name.

Read-Only

• endpoint (String) The Kubernetes API endpoint the kubeconfig is built against — carried beside the blob so a configuration can compose a provider's host input without re-deriving it from the YAML.
• kubeconfig (String, Sensitive) The raw kubeconfig YAML for the cluster, verbatim as the platform serves it. Feed it into the kubernetes and helm providers' kubeconfig inputs — the universal composition contract — without parsing the client key/certificate out of the YAML. It is SECRET material: it carries the cluster client's private key, it appears redacted in CLI output, and it still lands in Terraform state — protect that state accordingly. The non-secret pairing (the CA cert hash) lives on frostmoln_kubernetes_cluster.