I cannot seem to deploy with terraform and helm. Please advise.

[minmay]

I am getting this error and I don't know what I am doing wrong:

│ Error: Unable to continue with install: ClusterRole "strimzi-cluster-operator-namespaced" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "strimzi-cluster-operator"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "foobar"
│ 
│   with helm_release.strimzi-cluster-operator,
│   on main.tf line 18, in resource "helm_release" "strimzi-cluster-operator":
│   18: resource "helm_release" "strimzi-cluster-operator" {

Can somebody please advise me?

terraform script

Given this terraform script:

provider "kubernetes" {
  config_path    = "~/.kube/config"
}

provider "helm" {
  kubernetes {
    config_path = "~/.kube/config"
  }
}

resource "kubernetes_namespace" "foobar" {
  metadata {
    name = "foobar"
  }
}

# Helm chart for Strimzi Kafka.
resource "helm_release" "strimzi-cluster-operator" {
  name       = "strimzi-cluster-operator"
  repository = "https://strimzi.io/charts/"
  chart      = "strimzi-kafka-operator"
  version    = "0.45.0"
  namespace  = "foobar"
}

shell commands

then issuing these commands:

terraform init                                                                                                                                          1 ✘ 
Initializing the backend...
Initializing provider plugins...
- Finding latest version of hashicorp/kubernetes...
- Finding latest version of hashicorp/helm...
- Installing hashicorp/kubernetes v2.36.0...
- Installed hashicorp/kubernetes v2.36.0 (signed by HashiCorp)
- Installing hashicorp/helm v2.17.0...
- Installed hashicorp/helm v2.17.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

followed by

terraform apply                                                                                                                                     ✔  5s  

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # helm_release.strimzi-cluster-operator will be created
  + resource "helm_release" "strimzi-cluster-operator" {
      + atomic                     = false
      + chart                      = "strimzi-kafka-operator"
      + cleanup_on_fail            = false
      + create_namespace           = false
      + dependency_update          = false
      + disable_crd_hooks          = false
      + disable_openapi_validation = false
      + disable_webhooks           = false
      + force_update               = false
      + id                         = (known after apply)
      + lint                       = false
      + manifest                   = (known after apply)
      + max_history                = 0
      + metadata                   = (known after apply)
      + name                       = "strimzi-cluster-operator"
      + namespace                  = "foobar"
      + pass_credentials           = false
      + recreate_pods              = false
      + render_subchart_notes      = true
      + replace                    = false
      + repository                 = "https://strimzi.io/charts/"
      + reset_values               = false
      + reuse_values               = false
      + skip_crds                  = false
      + status                     = "deployed"
      + timeout                    = 300
      + verify                     = false
      + version                    = "0.45.0"
      + wait                       = true
      + wait_for_jobs              = false
    }

  # kubernetes_namespace.foobar will be created
  + resource "kubernetes_namespace" "foobar" {
      + id                               = (known after apply)
      + wait_for_default_service_account = false

      + metadata {
          + generation       = (known after apply)
          + name             = "foobar"
          + resource_version = (known after apply)
          + uid              = (known after apply)
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

kubernetes_namespace.foobar: Creating...
kubernetes_namespace.foobar: Creation complete after 0s [id=foobar]
helm_release.strimzi-cluster-operator: Creating...
╷
│ Error: Unable to continue with install: ClusterRole "strimzi-cluster-operator-namespaced" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "strimzi-cluster-operator"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "foobar"
│ 
│   with helm_release.strimzi-cluster-operator,
│   on main.tf line 18, in resource "helm_release" "strimzi-cluster-operator":
│   18: resource "helm_release" "strimzi-cluster-operator" {

[minmay]

I found a solution.
I found out that my custom resource definitions (crd) needed to be cleaned up.

kubectl get crd  
kafkabridges.kafka.strimzi.io         2025-03-29T23:00:41Z
kafkaconnectors.kafka.strimzi.io      2025-03-29T23:00:41Z
kafkaconnects.kafka.strimzi.io        2025-03-29T23:00:41Z
kafkamirrormaker2s.kafka.strimzi.io   2025-03-29T23:00:41Z
kafkamirrormakers.kafka.strimzi.io    2025-03-29T23:00:41Z
kafkanodepools.kafka.strimzi.io       2025-03-29T23:00:41Z
kafkarebalances.kafka.strimzi.io      2025-03-29T23:00:41Z
kafkas.kafka.strimzi.io               2025-03-29T23:00:41Z
kafkatopics.kafka.strimzi.io          2025-03-29T23:00:41Z
kafkausers.kafka.strimzi.io           2025-03-29T23:00:41Z
strimzipodsets.core.strimzi.io        2025-03-29T23:00:41Z                                                                 

followed by

kubectl delete crd kafkabridges.kafka.strimzi.io
kubectl delete crd kafkaconnectors.kafka.strimzi.io
kubectl delete crd kafkaconnects.kafka.strimzi.io
kubectl delete crd kafkamirrormaker2s.kafka.strimzi.io
kubectl delete crd kafkamirrormakers.kafka.strimzi.io
kubectl delete crd kafkanodepools.kafka.strimzi.io
kubectl delete crd kafkarebalances.kafka.strimzi.io
kubectl delete crd kafkas.kafka.strimzi.io
kubectl delete crd kafkatopics.kafka.strimzi.io
kubectl delete crd kafkausers.kafka.strimzi.io
kubectl delete crd strimzipodsets.core.strimzi.io

followed by

erraform apply                                                                                                                                         1 ✘ 

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # helm_release.strimzi-cluster-operator will be created
  + resource "helm_release" "strimzi-cluster-operator" {
      + atomic                     = false
      + chart                      = "strimzi-kafka-operator"
      + cleanup_on_fail            = false
      + create_namespace           = false
      + dependency_update          = false
      + disable_crd_hooks          = false
      + disable_openapi_validation = false
      + disable_webhooks           = false
      + force_update               = false
      + id                         = (known after apply)
      + lint                       = false
      + manifest                   = (known after apply)
      + max_history                = 0
      + metadata                   = (known after apply)
      + name                       = "strimzi-cluster-operator"
      + namespace                  = "default"
      + pass_credentials           = false
      + recreate_pods              = false
      + render_subchart_notes      = true
      + replace                    = false
      + repository                 = "https://strimzi.io/charts/"
      + reset_values               = false
      + reuse_values               = false
      + skip_crds                  = false
      + status                     = "deployed"
      + timeout                    = 300
      + verify                     = false
      + version                    = "0.45.0"
      + wait                       = true
      + wait_for_jobs              = false
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

helm_release.strimzi-cluster-operator: Creating...
helm_release.strimzi-cluster-operator: Still creating... [10s elapsed]
helm_release.strimzi-cluster-operator: Still creating... [20s elapsed]
helm_release.strimzi-cluster-operator: Still creating... [30s elapsed]
helm_release.strimzi-cluster-operator: Creation complete after 38s [id=strimzi-cluster-operator]

[im-konge]

Yeah sorry, I missed the discussion. This happens when you not clean up the resources. Glad you fix it. If there is anything else, please let us know!

[minmay]

thank you. This was vexing me all weekend.