How to fix Error: Error creating Kubernetes ConfigMap: configmaps already exists in Terraform

First, confirm that the ConfigMap actually exists in Kubernetes:

kubectl get configmap <configmap-name> -n <namespace>
kubectl describe configmap <configmap-name> -n <namespace>

Replace <configmap-name> and <namespace> with your actual values. If the ConfigMap is found, this confirms the conflict is real and you need to sync Terraform state or remove the resource.

If the ConfigMap should be managed by Terraform, import it into your Terraform state file:

terraform import kubernetes_config_map.example <namespace>/<configmap-name>

Or for kubernetes_config_map_v1:

terraform import kubernetes_config_map_v1.example <namespace>/<configmap-name>

For the aws-auth ConfigMap specifically:

terraform import kubernetes_config_map.aws_auth kube-system/aws-auth

This tells Terraform "this ConfigMap already exists and I'm taking over management of it". The import command updates your Terraform state file without recreating the resource.

If the ConfigMap is not critical or contains only generated data, delete it from the cluster and let Terraform recreate it:

kubectl delete configmap <configmap-name> -n <namespace>
terraform apply

WARNING: Only use this approach if:
- The ConfigMap data is not critical or can be regenerated
- You're certain no other systems depend on it
- You have backups if needed

For the aws-auth ConfigMap in EKS, do NOT delete it unless you know what you're doing - losing it can make nodes unable to join the cluster.

Instead of creating the ConfigMap with kubernetes_config_map resource, use a local-exec provisioner with kubectl apply for idempotent operations:

resource "null_resource" "configmap" {
  provisioner "local-exec" {
    command = "kubectl apply -f - <<EOF\n${file(${path.module}/configmap.yaml)}\nEOF"
  }

  triggers = {
    manifest = file("${path.module}/configmap.yaml")
  }
}

The kubectl apply command is idempotent - it updates if the resource exists or creates it if it doesn't, avoiding the "already exists" error.

If dealing with the aws-auth ConfigMap in EKS, consider managing it in a separate Terraform module or module phase:

1. Create the EKS cluster and node groups first (without the kubernetes provider managing aws-auth)
2. In a second apply, use a separate module with the kubernetes provider to manage aws-auth
3. Ensure the kubernetes provider credentials depend on the cluster being fully created first

This separation prevents the timing/order issues that cause "already exists" errors:

# First module: Create cluster
module "eks_cluster" {
  source = "./modules/eks-cluster"
}

# Second module: Manage aws-auth (depends on cluster being ready)
module "eks_auth" {
  source = "./modules/eks-auth"

  depends_on = [module.eks_cluster]

  cluster_id = module.eks_cluster.id
}

After resolving the error, verify that Terraform state matches your cluster:

terraform plan

The plan should show no changes. If it still shows the ConfigMap as needing to be created, the import or deletion didn't fully resolve the state mismatch.

You can also inspect the state file directly:

terraform state show kubernetes_config_map.example

This shows what Terraform thinks the state of this resource is.