Provisioning an underlying k8s cluster and using its outputs to configure a k8s provider leads to OpenTofu dependency hell. From https://search.opentofu.org/provider/opentofu/kubernetes/latest

The most reliable way to configure the Kubernetes provider is to ensure that the cluster itself and the Kubernetes provider resources can be managed with separate apply operations. Data-sources can be used to convey values between the two stages as needed.

Let's separate out the provisioning of the k8s cluster itself from the creation of in-cluster resources.