From 333f42c8bf9655743895acc76a2d0ac918c23335 Mon Sep 17 00:00:00 2001 From: Hristiyan Tonev <41945933+hvtonev@users.noreply.github.com> Date: Thu, 10 Jul 2025 17:41:38 +0300 Subject: [PATCH 01/18] issue-246: support longer project name --- eks.tf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/eks.tf b/eks.tf index 1029fb3..470ae1d 100644 --- a/eks.tf +++ b/eks.tf @@ -2,6 +2,8 @@ module "eks" { source = "terraform-aws-modules/eks/aws" version = "20.31.6" + iam_role_use_name_prefix = false + cluster_name = var.eks_cluster_name cluster_version = var.eks_cluster_version cluster_endpoint_private_access = true @@ -87,6 +89,8 @@ module "eks" { eks_managed_node_groups = { eks_workers = { + iam_role_use_name_prefix = false + name = "${var.eks_cluster_name}-ng" min_size = var.eks_ng_min_size max_size = var.eks_ng_max_size From 7bbbe1f566d9caa396e477cc8c987544e6944b6d Mon Sep 17 00:00:00 2001 From: Hristiyan Tonev <41945933+hvtonev@users.noreply.github.com> Date: Fri, 11 Jul 2025 11:31:04 +0300 Subject: [PATCH 02/18] issue-246: make long names toggleable --- eks.tf | 4 ++-- variables.tf | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/eks.tf b/eks.tf index 470ae1d..cefada8 100644 --- a/eks.tf +++ b/eks.tf @@ -2,7 +2,7 @@ module "eks" { source = "terraform-aws-modules/eks/aws" version = "20.31.6" - iam_role_use_name_prefix = false + iam_role_use_name_prefix = !var.allow_long_names cluster_name = var.eks_cluster_name cluster_version = var.eks_cluster_version @@ -89,7 +89,7 @@ module "eks" { eks_managed_node_groups = { eks_workers = { - iam_role_use_name_prefix = false + iam_role_use_name_prefix = !var.allow_long_names name = "${var.eks_cluster_name}-ng" min_size = var.eks_ng_min_size diff --git a/variables.tf b/variables.tf index bc5dbbc..66a0ccc 100644 --- a/variables.tf +++ b/variables.tf @@ -16,6 +16,12 @@ variable "environment" { description = "Environment in which resources are deployed" } +variable "allow_long_names" { + type = string + default = true + description = "Allows longer IAM role names without suffixes. Leave true for new clusters. Set to false for pre-existing clusters to avoid re-creation." +} + ################################################################################ # Networking variables ################################################################################ From b7135da98485c3670d5427bc815e3caf5e0ea976 Mon Sep 17 00:00:00 2001 From: Tsvetana Kanzova Date: Tue, 9 Sep 2025 15:41:16 +0300 Subject: [PATCH 03/18] Updated the AMI Type with supported one --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index 66a0ccc..390abc0 100644 --- a/variables.tf +++ b/variables.tf @@ -114,7 +114,7 @@ variable "access_entries" { variable "eks_ami_type" { description = "Default AMI type for the EKS worker nodes" type = string - default = "AL2_x86_64" + default = "BOTTLEROCKET_x86_64" } variable "eks_disk_size" { From aba72bb6e228919e17b4426a7e853434e5dc3121 Mon Sep 17 00:00:00 2001 From: Victoria Dimitrova Date: Tue, 7 Apr 2026 11:58:29 +0300 Subject: [PATCH 04/18] Update alb controller policy for version 3.1.0 --- irsa.tf | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/irsa.tf b/irsa.tf index 33a4a47..d37d8ca 100644 --- a/irsa.tf +++ b/irsa.tf @@ -166,6 +166,9 @@ resource "aws_iam_policy" "aws_load_balancer_controller" { "ec2:DescribeTags", "ec2:GetCoipPoolUsage", "ec2:DescribeCoipPools", + "ec2:GetSecurityGroupsForVpc", + "ec2:DescribeIpamPools", + "ec2:DescribeRouteTables", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeListeners", @@ -175,7 +178,10 @@ resource "aws_iam_policy" "aws_load_balancer_controller" { "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", - "elasticloadbalancing:DescribeTags" + "elasticloadbalancing:DescribeTags", + "elasticloadbalancing:DescribeTrustStores", + "elasticloadbalancing:DescribeListenerAttributes", + "elasticloadbalancing:DescribeCapacityReservation" ], "Resource": "*" }, @@ -324,7 +330,10 @@ resource "aws_iam_policy" "aws_load_balancer_controller" { "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", - "elasticloadbalancing:DeleteTargetGroup" + "elasticloadbalancing:DeleteTargetGroup", + "elasticloadbalancing:ModifyListenerAttributes", + "elasticloadbalancing:ModifyCapacityReservation", + "elasticloadbalancing:ModifyIpPools" ], "Resource": "*", "Condition": { @@ -370,7 +379,8 @@ resource "aws_iam_policy" "aws_load_balancer_controller" { "elasticloadbalancing:ModifyListener", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", - "elasticloadbalancing:ModifyRule" + "elasticloadbalancing:ModifyRule", + "elasticloadbalancing:SetRulePriorities" ], "Resource": "*" } @@ -378,4 +388,3 @@ resource "aws_iam_policy" "aws_load_balancer_controller" { } EOT } - From 45d80abe13ad8cdc55035acd08764dd52261df63 Mon Sep 17 00:00:00 2001 From: Hristiyan Tonev <41945933+hvtonev@users.noreply.github.com> Date: Wed, 13 May 2026 12:04:06 +0300 Subject: [PATCH 05/18] add efs addon support --- eks.tf | 31 ++++++++++++++++++++----------- irsa.tf | 20 ++++++++++++++++++++ variables.tf | 12 ++++++++++++ 3 files changed, 52 insertions(+), 11 deletions(-) diff --git a/eks.tf b/eks.tf index cefada8..390f5d9 100644 --- a/eks.tf +++ b/eks.tf @@ -19,17 +19,26 @@ module "eks" { cluster_enabled_log_types = var.cluster_enabled_log_types cloudwatch_log_group_retention_in_days = var.cluster_log_retention_in_days - cluster_addons = { - coredns = { - addon_version = var.addons_versions.coredns - } - kube-proxy = { - addon_version = var.addons_versions.kube_proxy - } - vpc-cni = { - service_account_role_arn = module.vpc_cni_irsa.iam_role_arn - } - } + cluster_addons = merge( + { + coredns = { + addon_version = var.addons_versions.coredns + } + kube-proxy = { + addon_version = var.addons_versions.kube_proxy + } + vpc-cni = { + service_account_role_arn = module.vpc_cni_irsa.iam_role_arn + } + }, + var.enable_efs_csi ? { + aws-efs-csi-driver = { + addon_version = var.addons_versions.efs_csi + service_account_role_arn = module.irsa-efs-csi.iam_role_arn + tags = tomap({ eks_addon = "efs_csi" }) + } + } : {} + ) cluster_security_group_additional_rules = { egress_nodes_ephemeral_ports_tcp = { diff --git a/irsa.tf b/irsa.tf index d37d8ca..776eb8c 100644 --- a/irsa.tf +++ b/irsa.tf @@ -38,6 +38,26 @@ module "irsa-ebs-csi" { } } +################################# +#IRSA for EFS-CSI addon for EKS # +################################# +module "irsa-efs-csi" { + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + version = "5.34.0" + + create_role = var.enable_efs_csi + role_name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" + role_policy_arns = { + efs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy" + } + oidc_providers = { + main = { + provider_arn = module.eks.oidc_provider_arn + namespace_service_accounts = ["kube-system:efs-csi-controller-sa"] + } + } +} + ##################################### #IRSA for External Secrets Operator # ##################################### diff --git a/variables.tf b/variables.tf index 390abc0..0d0855d 100644 --- a/variables.tf +++ b/variables.tf @@ -77,13 +77,25 @@ variable "cluster_log_retention_in_days" { default = 14 } +variable "enable_efs_csi" { + type = bool + description = "Enable EFS CSI EKS managed addon and its IRSA role" + default = false +} + variable "addons_versions" { type = object({ kube_proxy = string vpc_cni = string coredns = string ebs_csi = string + efs_csi = optional(string) }) + + validation { + condition = !var.enable_efs_csi || try(length(trimspace(var.addons_versions.efs_csi)) > 0, false) + error_message = "When enable_efs_csi is true, addons_versions.efs_csi must be set to a non-empty string." + } } variable "eks_tags" { From 10a36a97d7019be23befc7c739028517f4a09bc6 Mon Sep 17 00:00:00 2001 From: Hristiyan Tonev <41945933+hvtonev@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:27:34 +0300 Subject: [PATCH 06/18] Merge standard and EKS Auto Mode flows --- eks.tf | 18 +++++-- irsa.tf | 3 +- managed-karpenter.tf | 124 +++++++++++++++++++++++++++++++++++++++++++ outputs.tf | 10 +++- variables.tf | 42 +++++++++++++-- 5 files changed, 186 insertions(+), 11 deletions(-) create mode 100644 managed-karpenter.tf diff --git a/eks.tf b/eks.tf index 390f5d9..87dfdb6 100644 --- a/eks.tf +++ b/eks.tf @@ -2,7 +2,8 @@ module "eks" { source = "terraform-aws-modules/eks/aws" version = "20.31.6" - iam_role_use_name_prefix = !var.allow_long_names + iam_role_use_name_prefix = !var.allow_long_names + node_iam_role_use_name_prefix = !var.allow_long_names cluster_name = var.eks_cluster_name cluster_version = var.eks_cluster_version @@ -20,7 +21,7 @@ module "eks" { cloudwatch_log_group_retention_in_days = var.cluster_log_retention_in_days cluster_addons = merge( - { + var.enable_eks_auto_mode ? {} : { coredns = { addon_version = var.addons_versions.coredns } @@ -40,6 +41,10 @@ module "eks" { } : {} ) + cluster_compute_config = var.enable_eks_auto_mode ? { + enabled = true + } : {} + cluster_security_group_additional_rules = { egress_nodes_ephemeral_ports_tcp = { description = "To node 1025-65535" @@ -96,7 +101,7 @@ module "eks" { } } - eks_managed_node_groups = { + eks_managed_node_groups = var.enable_eks_auto_mode ? {} : { eks_workers = { iam_role_use_name_prefix = !var.allow_long_names @@ -127,7 +132,14 @@ module "eks" { } +moved { + from = aws_eks_addon.ebs-csi + to = aws_eks_addon.ebs-csi[0] +} + resource "aws_eks_addon" "ebs-csi" { + count = var.enable_eks_auto_mode ? 0 : 1 + cluster_name = module.eks.cluster_name addon_name = "aws-ebs-csi-driver" addon_version = var.addons_versions.ebs_csi diff --git a/irsa.tf b/irsa.tf index 776eb8c..75b4f88 100644 --- a/irsa.tf +++ b/irsa.tf @@ -5,6 +5,7 @@ module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" version = "5.34.0" + create_role = !var.enable_eks_auto_mode role_name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" attach_vpc_cni_policy = true vpc_cni_enable_ipv6 = false @@ -25,7 +26,7 @@ module "irsa-ebs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" version = "5.34.0" - create_role = true + create_role = !var.enable_eks_auto_mode role_name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" role_policy_arns = { ebs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" diff --git a/managed-karpenter.tf b/managed-karpenter.tf new file mode 100644 index 0000000..22c0f68 --- /dev/null +++ b/managed-karpenter.tf @@ -0,0 +1,124 @@ +data "aws_availability_zones" "available" { + count = var.enable_eks_auto_mode ? 1 : 0 + + state = "available" +} + +moved { + from = kubectl_manifest.karpenter_nodeclass + to = kubectl_manifest.karpenter_nodeclass[0] +} + +resource "kubectl_manifest" "karpenter_nodeclass" { + count = var.enable_eks_auto_mode ? 1 : 0 + + lifecycle { + precondition { + condition = length(trimspace(var.project_name)) > 0 + error_message = "project_name must be set when enable_eks_auto_mode is true." + } + } + + yaml_body = < 0~} + - key: node.kubernetes.io/instance-type + operator: In + values: +%{for instance in var.karpenter_allowed_instance_types~} + - ${instance} +%{endfor~} +%{endif~} +YAML +} + +moved { + from = aws_eks_access_entry.karpenter + to = aws_eks_access_entry.karpenter[0] +} + +resource "aws_eks_access_entry" "karpenter" { + count = var.enable_eks_auto_mode ? 1 : 0 + + cluster_name = module.eks.cluster_name + principal_arn = module.eks.node_iam_role_arn + type = "EC2" +} + +moved { + from = aws_eks_access_policy_association.karpenter_auto_policy + to = aws_eks_access_policy_association.karpenter_auto_policy[0] +} + +resource "aws_eks_access_policy_association" "karpenter_auto_policy" { + count = var.enable_eks_auto_mode ? 1 : 0 + + cluster_name = module.eks.cluster_name + principal_arn = aws_eks_access_entry.karpenter[0].principal_arn + policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAutoNodePolicy" + + access_scope { + type = "cluster" + } + + depends_on = [ + aws_eks_access_entry.karpenter + ] +} diff --git a/outputs.tf b/outputs.tf index 73b409d..f01ed8a 100644 --- a/outputs.tf +++ b/outputs.tf @@ -28,11 +28,17 @@ output "node_security_group_id" { } output "node_iam_role_name" { - value = module.eks.eks_managed_node_groups["eks_workers"].iam_role_name + description = "Name of the IAM role used by EKS worker nodes" + value = var.enable_eks_auto_mode ? module.eks.node_iam_role_name : ( + module.eks.eks_managed_node_groups["eks_workers"].iam_role_name + ) } output "node_iam_role_arn" { - value = module.eks.eks_managed_node_groups["eks_workers"].iam_role_arn + description = "ARN of the IAM role used by EKS worker nodes" + value = var.enable_eks_auto_mode ? module.eks.node_iam_role_arn : ( + module.eks.eks_managed_node_groups["eks_workers"].iam_role_arn + ) } output "oidc_provider_arn" { diff --git a/variables.tf b/variables.tf index 0d0855d..b88dbc8 100644 --- a/variables.tf +++ b/variables.tf @@ -16,6 +16,12 @@ variable "environment" { description = "Environment in which resources are deployed" } +variable "project_name" { + type = string + description = "Name of the project, client, or product used to tag EKS Auto Mode nodes" + default = "" +} + variable "allow_long_names" { type = string default = true @@ -77,6 +83,12 @@ variable "cluster_log_retention_in_days" { default = 14 } +variable "enable_eks_auto_mode" { + type = bool + description = "Enable EKS Auto Mode instead of the managed node group and standard EKS add-ons" + default = false +} + variable "enable_efs_csi" { type = bool description = "Enable EFS CSI EKS managed addon and its IRSA role" @@ -84,17 +96,31 @@ variable "enable_efs_csi" { } variable "addons_versions" { + description = "Versions of the standard EKS add-ons; required when EKS Auto Mode is disabled" type = object({ - kube_proxy = string - vpc_cni = string - coredns = string - ebs_csi = string + kube_proxy = optional(string) + vpc_cni = optional(string) + coredns = optional(string) + ebs_csi = optional(string) efs_csi = optional(string) }) + default = null + + validation { + condition = var.enable_eks_auto_mode || try(alltrue([ + for version in [ + var.addons_versions.kube_proxy, + var.addons_versions.vpc_cni, + var.addons_versions.coredns, + var.addons_versions.ebs_csi, + ] : length(trimspace(version)) > 0 + ]), false) + error_message = "Normal mode requires non-empty kube_proxy, vpc_cni, coredns, and ebs_csi versions." + } validation { condition = !var.enable_efs_csi || try(length(trimspace(var.addons_versions.efs_csi)) > 0, false) - error_message = "When enable_efs_csi is true, addons_versions.efs_csi must be set to a non-empty string." + error_message = "enable_efs_csi requires a non-empty efs_csi version." } } @@ -185,6 +211,12 @@ variable "eks_ng_capacity_type" { default = "SPOT" } +variable "karpenter_allowed_instance_types" { + description = "Optional instance types allowed by the EKS Auto Mode NodePool; an empty list applies no instance type restriction" + type = list(string) + default = [] +} + variable "kms_key_enable_default_policy" { description = "Specifies whether to enable the default key policy. Defaults to `true`" type = bool From 135e4ca624d7a2a80fd40b9f2ea6ab53c6024e92 Mon Sep 17 00:00:00 2001 From: Hristiyan Tonev <41945933+hvtonev@users.noreply.github.com> Date: Wed, 22 Jul 2026 09:17:49 +0300 Subject: [PATCH 07/18] upgrade the eks module to v21.23.0 --- eks.tf | 93 +++++++++++++++++++++++++++++++--------------------- main.tf | 8 +++-- variables.tf | 18 ++++++---- 3 files changed, 73 insertions(+), 46 deletions(-) diff --git a/eks.tf b/eks.tf index 87dfdb6..ead384b 100644 --- a/eks.tf +++ b/eks.tf @@ -1,35 +1,46 @@ module "eks" { source = "terraform-aws-modules/eks/aws" - version = "20.31.6" + version = "21.23.0" iam_role_use_name_prefix = !var.allow_long_names node_iam_role_use_name_prefix = !var.allow_long_names - cluster_name = var.eks_cluster_name - cluster_version = var.eks_cluster_version - cluster_endpoint_private_access = true - cluster_endpoint_public_access = true - cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs - cluster_security_group_name = "${var.eks_cluster_name}-sg" - enable_irsa = true + name = var.eks_cluster_name + kubernetes_version = var.eks_cluster_version + endpoint_private_access = true + endpoint_public_access = true + endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs + security_group_name = "${var.eks_cluster_name}-sg" + enable_irsa = true access_entries = local.merged_access_entries + iam_role_additional_policies = var.enable_eks_auto_mode ? {} : { + AmazonEKSVPCResourceController = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController" + } + ## Control plane logging create_cloudwatch_log_group = true - cluster_enabled_log_types = var.cluster_enabled_log_types + enabled_log_types = var.cluster_enabled_log_types cloudwatch_log_group_retention_in_days = var.cluster_log_retention_in_days - cluster_addons = merge( + addons = merge( var.enable_eks_auto_mode ? {} : { coredns = { addon_version = var.addons_versions.coredns + + resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create } kube-proxy = { addon_version = var.addons_versions.kube_proxy + + resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create } vpc-cni = { + addon_version = var.addons_versions.vpc_cni service_account_role_arn = module.vpc_cni_irsa.iam_role_arn + + resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create } }, var.enable_efs_csi ? { @@ -37,15 +48,17 @@ module "eks" { addon_version = var.addons_versions.efs_csi service_account_role_arn = module.irsa-efs-csi.iam_role_arn tags = tomap({ eks_addon = "efs_csi" }) + + resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create } } : {} ) - cluster_compute_config = var.enable_eks_auto_mode ? { + compute_config = var.enable_eks_auto_mode ? { enabled = true - } : {} + } : null - cluster_security_group_additional_rules = { + security_group_additional_rules = { egress_nodes_ephemeral_ports_tcp = { description = "To node 1025-65535" protocol = "tcp" @@ -67,7 +80,7 @@ module "eks" { } } - cluster_ip_family = "ipv4" + ip_family = "ipv4" create_cni_ipv6_iam_policy = false vpc_id = var.vpc_id @@ -77,34 +90,19 @@ module "eks" { # EKS Managed Node Group(s) - eks_managed_node_group_defaults = { - ami_type = var.eks_ami_type - disk_size = var.eks_disk_size - instance_types = var.eks_instance_types - - iam_role_attach_cni_policy = true - - iam_role_additional_policies = var.eks_node_additional_policies - - block_device_mappings = { - xvda = { - device_name = "/dev/xvda" - ebs = { - volume_size = var.eks_disk_size - volume_type = var.eks_volume_type - iops = var.eks_volume_iops - throughput = 150 - encrypted = true - delete_on_termination = true - } - } - } - } - eks_managed_node_groups = var.enable_eks_auto_mode ? {} : { eks_workers = { iam_role_use_name_prefix = !var.allow_long_names + ami_type = var.eks_ami_type + disk_size = var.eks_disk_size + instance_types = var.eks_instance_types + + iam_role_attach_cni_policy = true + iam_role_additional_policies = var.eks_node_additional_policies + enable_monitoring = true + use_latest_ami_release_version = false + name = "${var.eks_cluster_name}-ng" min_size = var.eks_ng_min_size max_size = var.eks_ng_max_size @@ -112,6 +110,20 @@ module "eks" { ebs_optimized = true + block_device_mappings = { + xvda = { + device_name = "/dev/xvda" + ebs = { + volume_size = var.eks_disk_size + volume_type = var.eks_volume_type + iops = var.eks_volume_iops + throughput = 150 + encrypted = true + delete_on_termination = true + } + } + } + metadata_options = { http_endpoint = "enabled" http_tokens = "required" @@ -137,6 +149,11 @@ moved { to = aws_eks_addon.ebs-csi[0] } +moved { + from = module.eks.aws_iam_role_policy_attachment.this["AmazonEKSVPCResourceController"] + to = module.eks.aws_iam_role_policy_attachment.additional["AmazonEKSVPCResourceController"] +} + resource "aws_eks_addon" "ebs-csi" { count = var.enable_eks_auto_mode ? 0 : 1 diff --git a/main.tf b/main.tf index 76600fe..6799686 100644 --- a/main.tf +++ b/main.tf @@ -1,10 +1,10 @@ terraform { - required_version = ">= 1.3" + required_version = ">= 1.5.7" required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.34" + version = ">= 6.42, < 7.0" } kubernetes = { source = "hashicorp/kubernetes" @@ -22,5 +22,9 @@ terraform { source = "hashicorp/random" version = ">= 3" } + tls = { + source = "hashicorp/tls" + version = ">= 4.0" + } } } diff --git a/variables.tf b/variables.tf index b88dbc8..fd0271f 100644 --- a/variables.tf +++ b/variables.tf @@ -96,13 +96,14 @@ variable "enable_efs_csi" { } variable "addons_versions" { - description = "Versions of the standard EKS add-ons; required when EKS Auto Mode is disabled" + description = "Configuration of the standard EKS add-ons; versions are required when EKS Auto Mode is disabled" type = object({ - kube_proxy = optional(string) - vpc_cni = optional(string) - coredns = optional(string) - ebs_csi = optional(string) - efs_csi = optional(string) + kube_proxy = optional(string) + vpc_cni = optional(string) + coredns = optional(string) + ebs_csi = optional(string) + efs_csi = optional(string) + resolve_conflicts_on_create = optional(string, "OVERWRITE") }) default = null @@ -122,6 +123,11 @@ variable "addons_versions" { condition = !var.enable_efs_csi || try(length(trimspace(var.addons_versions.efs_csi)) > 0, false) error_message = "enable_efs_csi requires a non-empty efs_csi version." } + + validation { + condition = try(contains(["NONE", "OVERWRITE"], var.addons_versions.resolve_conflicts_on_create), true) + error_message = "addons_versions.resolve_conflicts_on_create must be one of: NONE, OVERWRITE." + } } variable "eks_tags" { From 3822938e2b82a0158ba55a1ec60e1562f46e51ee Mon Sep 17 00:00:00 2001 From: Hristiyan Tonev <41945933+hvtonev@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:22:37 +0300 Subject: [PATCH 08/18] fix addons bootstrap order --- eks.tf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/eks.tf b/eks.tf index ead384b..711d543 100644 --- a/eks.tf +++ b/eks.tf @@ -38,6 +38,7 @@ module "eks" { } vpc-cni = { addon_version = var.addons_versions.vpc_cni + before_compute = true service_account_role_arn = module.vpc_cni_irsa.iam_role_arn resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create @@ -165,4 +166,8 @@ resource "aws_eks_addon" "ebs-csi" { var.eks_tags, tomap({ eks_addon = "ebs_csi" }) ) + + depends_on = [ + module.eks + ] } From 8cd241dab38239f42842073e87bee6f89e156074 Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 15:48:05 +0300 Subject: [PATCH 09/18] Update role eks module to include ec2:describeSubnet --- irsa.tf | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/irsa.tf b/irsa.tf index 75b4f88..8d54409 100644 --- a/irsa.tf +++ b/irsa.tf @@ -3,7 +3,7 @@ ################################# module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.34.0" + version = "6.8.0" create_role = !var.enable_eks_auto_mode role_name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" @@ -24,7 +24,7 @@ module "vpc_cni_irsa" { ################################# module "irsa-ebs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.34.0" + version = "6.8.0" create_role = !var.enable_eks_auto_mode role_name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" @@ -44,7 +44,7 @@ module "irsa-ebs-csi" { ################################# module "irsa-efs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.34.0" + version = "6.8.0" create_role = var.enable_efs_csi role_name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" @@ -64,7 +64,7 @@ module "irsa-efs-csi" { ##################################### module "iam_assumable_role_admin_secrets_operator" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.34.0" + version = "6.8.0" create_role = true role_name = "${var.eks_cluster_name}-secrets-operator" @@ -84,7 +84,7 @@ module "iam_assumable_role_admin_secrets_operator" { ######################## module "iam_assumable_role_external_dns" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.34.0" + version = "6.8.0" create_role = true role_name = "${var.eks_cluster_name}-external-dns" From b79c5e63cdf164dff76562729f9046dc2ce249fb Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 16:03:01 +0300 Subject: [PATCH 10/18] Update to new AWS module structure iam-role-for-service-accounts-eks --- irsa.tf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/irsa.tf b/irsa.tf index 8d54409..d9aec68 100644 --- a/irsa.tf +++ b/irsa.tf @@ -2,7 +2,7 @@ #IRSA for VPC-CNI addon for EKS # ################################# module "vpc_cni_irsa" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" create_role = !var.enable_eks_auto_mode @@ -23,7 +23,7 @@ module "vpc_cni_irsa" { #IRSA for EBS-CSI addon for EKS # ################################# module "irsa-ebs-csi" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" create_role = !var.enable_eks_auto_mode @@ -43,7 +43,7 @@ module "irsa-ebs-csi" { #IRSA for EFS-CSI addon for EKS # ################################# module "irsa-efs-csi" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" create_role = var.enable_efs_csi @@ -63,7 +63,7 @@ module "irsa-efs-csi" { #IRSA for External Secrets Operator # ##################################### module "iam_assumable_role_admin_secrets_operator" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" create_role = true @@ -83,7 +83,7 @@ module "iam_assumable_role_admin_secrets_operator" { #IRSA for External DNS # ######################## module "iam_assumable_role_external_dns" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" create_role = true @@ -135,7 +135,7 @@ EOT ########################## module "iam_assumable_role_admin_aws_load_balancer_controller" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "5.34.0" create_role = true From ea5aa31f78fe6900463291a05344c04ee640b2ff Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 16:19:07 +0300 Subject: [PATCH 11/18] Update to new AWS module structure iam-role-for-service-accounts-eks --- irsa.tf | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/irsa.tf b/irsa.tf index d9aec68..939cd37 100644 --- a/irsa.tf +++ b/irsa.tf @@ -5,8 +5,8 @@ module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create_role = !var.enable_eks_auto_mode - role_name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" + create = !var.enable_eks_auto_mode + name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" attach_vpc_cni_policy = true vpc_cni_enable_ipv6 = false vpc_cni_enable_ipv4 = true @@ -26,9 +26,9 @@ module "irsa-ebs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create_role = !var.enable_eks_auto_mode - role_name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" - role_policy_arns = { + create = !var.enable_eks_auto_mode + name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" + policies = { ebs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" } oidc_providers = { @@ -46,9 +46,9 @@ module "irsa-efs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create_role = var.enable_efs_csi - role_name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" - role_policy_arns = { + create = var.enable_efs_csi + name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" + policies = { efs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy" } oidc_providers = { @@ -66,9 +66,9 @@ module "iam_assumable_role_admin_secrets_operator" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create_role = true - role_name = "${var.eks_cluster_name}-secrets-operator" - role_policy_arns = { + create = true + name = "${var.eks_cluster_name}-secrets-operator" + policies = { eso_policy = aws_iam_policy.secrets_operator.arn } oidc_providers = { @@ -86,9 +86,9 @@ module "iam_assumable_role_external_dns" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create_role = true - role_name = "${var.eks_cluster_name}-external-dns" - role_policy_arns = { + create = true + name = "${var.eks_cluster_name}-external-dns" + policies = { external_dns_policy = "arn:aws:iam::aws:policy/AmazonRoute53FullAccess" } oidc_providers = { @@ -138,9 +138,9 @@ module "iam_assumable_role_admin_aws_load_balancer_controller" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "5.34.0" - create_role = true - role_name = "aws-load-balancer-controller-${var.eks_cluster_name}" - role_policy_arns = { + create = true + name = "aws-load-balancer-controller-${var.eks_cluster_name}" + policies = { alb_controller_policy = aws_iam_policy.aws_load_balancer_controller.arn } oidc_providers = { From 181753bc5e54e775c364303fda2416c9740b5ed2 Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 16:26:21 +0300 Subject: [PATCH 12/18] Update to new AWS module structure iam-role-for-service-accounts-eks --- irsa.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/irsa.tf b/irsa.tf index 939cd37..8daa96f 100644 --- a/irsa.tf +++ b/irsa.tf @@ -136,7 +136,7 @@ EOT module "iam_assumable_role_admin_aws_load_balancer_controller" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" - version = "5.34.0" + version = "6.8.0" create = true name = "aws-load-balancer-controller-${var.eks_cluster_name}" From bfc02daa347bf7c4f8ec6b0a8b5821d0a0080bf0 Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 16:44:45 +0300 Subject: [PATCH 13/18] Update to new AWS module structure iam-role-for-service-accounts-eks --- eks.tf | 4 ++-- outputs.tf | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/eks.tf b/eks.tf index 711d543..b295b1a 100644 --- a/eks.tf +++ b/eks.tf @@ -39,7 +39,7 @@ module "eks" { vpc-cni = { addon_version = var.addons_versions.vpc_cni before_compute = true - service_account_role_arn = module.vpc_cni_irsa.iam_role_arn + service_account_role_arn = module.vpc_cni_irsa.arn resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create } @@ -47,7 +47,7 @@ module "eks" { var.enable_efs_csi ? { aws-efs-csi-driver = { addon_version = var.addons_versions.efs_csi - service_account_role_arn = module.irsa-efs-csi.iam_role_arn + service_account_role_arn = module.irsa-ebs-csi.arn tags = tomap({ eks_addon = "efs_csi" }) resolve_conflicts_on_create = var.addons_versions.resolve_conflicts_on_create diff --git a/outputs.tf b/outputs.tf index f01ed8a..1422b8d 100644 --- a/outputs.tf +++ b/outputs.tf @@ -19,7 +19,7 @@ output "eks_cluster_version" { } output "eks_irsa_external_dns_arn" { - value = module.iam_assumable_role_external_dns.iam_role_arn + value = module.iam_assumable_role_external_dns.arn } output "node_security_group_id" { From 30558bad200cf3f61c4215ab9eee39a13eefe65b Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 17:08:00 +0300 Subject: [PATCH 14/18] Update to new AWS module structure iam-role-for-service-accounts-eks --- eks.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eks.tf b/eks.tf index b295b1a..f4cf249 100644 --- a/eks.tf +++ b/eks.tf @@ -161,7 +161,7 @@ resource "aws_eks_addon" "ebs-csi" { cluster_name = module.eks.cluster_name addon_name = "aws-ebs-csi-driver" addon_version = var.addons_versions.ebs_csi - service_account_role_arn = module.irsa-ebs-csi.iam_role_arn + service_account_role_arn = module.irsa-ebs-csi.arn tags = merge( var.eks_tags, tomap({ eks_addon = "ebs_csi" }) From 5c4935df8b0ba50af99695004a0bf5ec1676c724 Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 18:42:30 +0300 Subject: [PATCH 15/18] Set min provider version to 6.57.1 as there is a malfromed request problem in 6.57.0 --- main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.tf b/main.tf index 6799686..5a2999a 100644 --- a/main.tf +++ b/main.tf @@ -4,7 +4,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 6.42, < 7.0" + version = ">= 6.57.1, < 7.0" } kubernetes = { source = "hashicorp/kubernetes" From b6751074ee941fd4484e49278decd6c889ffe359 Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 18:58:32 +0300 Subject: [PATCH 16/18] Set min provider version to 6.57.1 as there is a malfromed request problem in 6.57.0 --- main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.tf b/main.tf index 5a2999a..a2858f9 100644 --- a/main.tf +++ b/main.tf @@ -4,7 +4,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 6.57.1, < 7.0" + version = ">= 6.42, != 6.57.0, < 7.0" } kubernetes = { source = "hashicorp/kubernetes" From 62edd944db871158dc9d77c24fa7ea9e68a15b69 Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Wed, 29 Jul 2026 20:19:20 +0300 Subject: [PATCH 17/18] set use_name_prefix = false as default now is true --- irsa.tf | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/irsa.tf b/irsa.tf index 8daa96f..dd5b7df 100644 --- a/irsa.tf +++ b/irsa.tf @@ -7,6 +7,8 @@ module "vpc_cni_irsa" { create = !var.enable_eks_auto_mode name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" + use_name_prefix = false + attach_vpc_cni_policy = true vpc_cni_enable_ipv6 = false vpc_cni_enable_ipv4 = true @@ -28,6 +30,9 @@ module "irsa-ebs-csi" { create = !var.enable_eks_auto_mode name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" + + use_name_prefix = false + policies = { ebs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" } @@ -48,6 +53,9 @@ module "irsa-efs-csi" { create = var.enable_efs_csi name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" + + use_name_prefix = false + policies = { efs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy" } @@ -68,6 +76,9 @@ module "iam_assumable_role_admin_secrets_operator" { create = true name = "${var.eks_cluster_name}-secrets-operator" + + use_name_prefix = false + policies = { eso_policy = aws_iam_policy.secrets_operator.arn } @@ -88,6 +99,9 @@ module "iam_assumable_role_external_dns" { create = true name = "${var.eks_cluster_name}-external-dns" + + use_name_prefix = false + policies = { external_dns_policy = "arn:aws:iam::aws:policy/AmazonRoute53FullAccess" } @@ -140,6 +154,9 @@ module "iam_assumable_role_admin_aws_load_balancer_controller" { create = true name = "aws-load-balancer-controller-${var.eks_cluster_name}" + + use_name_prefix = false + policies = { alb_controller_policy = aws_iam_policy.aws_load_balancer_controller.arn } From 9263bcf8de3bc9ad649bced82ed583b3912cdfbc Mon Sep 17 00:00:00 2001 From: mvukadinoff Date: Thu, 30 Jul 2026 10:56:56 +0300 Subject: [PATCH 18/18] Static policy names --- irsa.tf | 39 ++++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/irsa.tf b/irsa.tf index dd5b7df..e50f01e 100644 --- a/irsa.tf +++ b/irsa.tf @@ -5,9 +5,10 @@ module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create = !var.enable_eks_auto_mode - name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" - use_name_prefix = false + create = !var.enable_eks_auto_mode + name = "AmazonEKS-VPC-CNI-${var.eks_cluster_name}" + policy_name = "VPC_CNI_IPv4-${var.eks_cluster_name}" + use_name_prefix = false attach_vpc_cni_policy = true vpc_cni_enable_ipv6 = false @@ -28,10 +29,10 @@ module "irsa-ebs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create = !var.enable_eks_auto_mode - name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" - - use_name_prefix = false + create = !var.enable_eks_auto_mode + name = "AmazonEKS-EBS-CSI-${var.eks_cluster_name}" + policy_name = "EBS-CSI-${var.eks_cluster_name}" + use_name_prefix = false policies = { ebs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" @@ -51,10 +52,10 @@ module "irsa-efs-csi" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create = var.enable_efs_csi - name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" - - use_name_prefix = false + create = var.enable_efs_csi + name = "AmazonEKS-EFS-CSI-${var.eks_cluster_name}" + policy_name = "EFS-CSI-${var.eks_cluster_name}" + use_name_prefix = false policies = { efs_csi_policy = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy" @@ -74,10 +75,10 @@ module "iam_assumable_role_admin_secrets_operator" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create = true - name = "${var.eks_cluster_name}-secrets-operator" - - use_name_prefix = false + create = true + name = "${var.eks_cluster_name}-secrets-operator" + policy_name = "${var.eks_cluster_name}-secrets-operator" + use_name_prefix = false policies = { eso_policy = aws_iam_policy.secrets_operator.arn @@ -97,10 +98,10 @@ module "iam_assumable_role_external_dns" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts" version = "6.8.0" - create = true - name = "${var.eks_cluster_name}-external-dns" - - use_name_prefix = false + create = true + name = "${var.eks_cluster_name}-external-dns" + policy_name = "${var.eks_cluster_name}-external-dns" + use_name_prefix = false policies = { external_dns_policy = "arn:aws:iam::aws:policy/AmazonRoute53FullAccess"