diff --git a/docs/data-sources/kube_config.md b/docs/data-sources/kube_config.md
index 5fd23561..9dc90824 100644
--- a/docs/data-sources/kube_config.md
+++ b/docs/data-sources/kube_config.md
@@ -31,7 +31,7 @@ The following arguments are supported:
 - `server` - (Computed) - String - Kubernetes server url.
 - `context` - (Computed) - String - Kubernetes context.
 - `namespace` - (Computed) - String - Kubernetes namespace.
-- `kube_user` - (Computed) - String - Kubernetes user.
+- `kube_user` - (Sensitive) - (Computed) - String - Kubernetes user.
 - `kube_password` - (Sensitive) - (Computed) - String - Kubernetes password.
 - `ca_cert` - (Sensitive) - (Computed) - String - Kubernetes cluster certificate.
 - `client_cert` - (Sensitive) - (Computed) - String - Kubernetes client certificate.
diff --git a/hack/gen-tf-code/main.go b/hack/gen-tf-code/main.go
index 8dc18bba..593f48f0 100644
--- a/hack/gen-tf-code/main.go
+++ b/hack/gen-tf-code/main.go
@@ -340,7 +340,7 @@ func main() {
 		),
 		generate(kube.Config{},
 			noSchema(),
-			sensitive("KubeBearerToken", "KubePassword", "CaCert", "ClientCert", "ClientKey"),
+			sensitive("KubeUser", "KubePassword", "CaCert", "ClientCert", "ClientKey"),
 		),
 		generate(kops.ClusterSpec{},
 			exclude("GossipConfig", "DNSControllerGossipConfig", "Target"),
diff --git a/hack/gen-tf-code/options.go b/hack/gen-tf-code/options.go
index 579404e6..afbf6412 100644
--- a/hack/gen-tf-code/options.go
+++ b/hack/gen-tf-code/options.go
@@ -116,6 +116,9 @@ func doc(header, footer string) func(o *options) {
 }
 
 func (o *options) verify(t reflect.Type) error {
+	if err := verifyFields(t, o.sensitive.List()...); err != nil {
+		return err
+	}
 	if err := verifyFields(t, o.exclude.List()...); err != nil {
 		return err
 	}
diff --git a/pkg/api/kube/Kube.go b/pkg/api/kube/Config.go
similarity index 100%
rename from pkg/api/kube/Kube.go
rename to pkg/api/kube/Config.go
diff --git a/pkg/schemas/datasources/DataSource_KubeConfig.generated.go b/pkg/schemas/datasources/DataSource_KubeConfig.generated.go
index 79affb5e..debc73cb 100644
--- a/pkg/schemas/datasources/DataSource_KubeConfig.generated.go
+++ b/pkg/schemas/datasources/DataSource_KubeConfig.generated.go
@@ -22,7 +22,7 @@ func DataSourceKubeConfig() *schema.Resource {
 			"server":        ComputedString(),
 			"context":       ComputedString(),
 			"namespace":     ComputedString(),
-			"kube_user":     ComputedString(),
+			"kube_user":     Sensitive(ComputedString()),
 			"kube_password": Sensitive(ComputedString()),
 			"ca_cert":       Sensitive(ComputedString()),
 			"client_cert":   Sensitive(ComputedString()),