Problem Summary
This Terraform module relies on an parent module for the creation of an EKS cluster. Starting with v18.0.0, the module no longer supports management of the aws-auth ConfigMap.
In order for us to stay up to date with the EKS parent module, an alternative method of managing the aws-auth ConfigMap is necessary.
In addition to this issue, versions <=v17.X.X of the EKS parent module address an issue where IAM Path's are not recognized using the aws-iam-authenticator plugin, by stripping any IAM Paths in the role arn used by worker nodes.
This issue has since been fixed by AWS and IAM Paths are now properly recognized in the aws-auth ConfigMap for EKS clusters. However, even though the role arn with the stripped IAM Path is still usable by the worker nodes, the EKS API does not recognize them and thinks the cluster is in a degraded state.
This results in the nodes showing a Degraded status and EKS does not allow their configuration to be changed/updated (changing ASG settings, for instance).
Proposed Changes
This terraform module needs the ability to manage the aws-auth ConfigMap in order to add a role mapping for management by the StreamNative Control Plane.
We should bring this functionality native to our module, which will:
- Enable us to upgrade to newer versions of the EKS parent module (>=
v18.X.X)
- Remove the custom logic used in versions <=
v17.X.X that removes IAM Paths from the worker node role ARN
Problem Summary
This Terraform module relies on an parent module for the creation of an EKS cluster. Starting with
v18.0.0, the module no longer supports management of theaws-authConfigMap.In order for us to stay up to date with the EKS parent module, an alternative method of managing the
aws-authConfigMap is necessary.In addition to this issue, versions <=
v17.X.Xof the EKS parent module address an issue where IAM Path's are not recognized using theaws-iam-authenticatorplugin, by stripping any IAM Paths in the role arn used by worker nodes.This issue has since been fixed by AWS and IAM Paths are now properly recognized in the
aws-authConfigMap for EKS clusters. However, even though the role arn with the stripped IAM Path is still usable by the worker nodes, the EKS API does not recognize them and thinks the cluster is in a degraded state.This results in the nodes showing a
Degradedstatus and EKS does not allow their configuration to be changed/updated (changing ASG settings, for instance).Proposed Changes
This terraform module needs the ability to manage the
aws-authConfigMap in order to add a role mapping for management by the StreamNative Control Plane.We should bring this functionality native to our module, which will:
v18.X.X)v17.X.Xthat removes IAM Paths from the worker node role ARN