No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

This worked for me once the cluster was created.
```const clusterDataSource = cluster.name.apply(name =&gt; digitalocean.getKubernetesCluster({name}));
const kubeconfig = clusterDataSource.kubeConfigs[0].rawConfig;```

The `certificate-authority-data` field changes on every update, but shouldn’t affect things otherwise AFAICT

I was getting an error on `getKubernetesCluster` if the cluster didn’t exist yet, but this should do the trick:
```const cluster = new digitalocean.KubernetesCluster("do-cluster", {
    region: digitalocean.Regions.SFO2,
    version: digitalocean.getKubernetesVersions({versionPrefix: "1.16"}).then(p =&gt; p.latestVersion),
    nodePool: {
        name: "default",
        size: digitalocean.DropletSlugs.DropletS2VCPU2GB,
        nodeCount: 2,
    },
});
const kubeconfig = cluster.status.apply(status =&gt; {
    if (status === 'running') {
        const clusterDataSource = cluster.name.apply(name =&gt; digitalocean.getKubernetesCluster({name}));
        return clusterDataSource.kubeConfigs[0].rawConfig;
    } else {
        return cluster.kubeConfigs[0].rawConfig;
    }
});
const provider = new k8s.Provider("k8s", {kubeconfig});```

Thank you <@UE1LN7A22>!
Didn’t try it with a new cluster yet but so far it seems to work.

I also figured out how to avoid the diff on kubeconfig everytime:
`new k8s.Provider("k8s", {kubeconfig}, { ignoreChanges: ["kubeconfig"] });`
Not sure if this will have some side effects but for now it seems to work.

The provider has logic to replace resources if the underlying cluster changes. We try to detect that from the kubeconfig, so `ignoreChanges` will bypass that checking. As long as you’re aware of that, should be fine