apply-secrets will not work when you already have an existing environment set up because terraform tries to create the ci-user again.
For apply-env, terraform also tries to recreate these policies with the same name and it fails:
eks_list_and_describe_policy ci_user_list_and_describe_policy (https://github.com/commitdev/zero-aws-eks-stack/blob/master/templates/terraform/modules/environment/iam.tf)