You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This Terraform module relies on an parent module for the creation of an EKS cluster. Starting with v18.0.0, the module no longer supports management of the aws-auth ConfigMap.
In order for us to stay up to date with the EKS parent module, an alternative method of managing the aws-auth ConfigMap is necessary.
In addition to this issue, versions <=v17.X.X of the EKS parent module address an issue where IAM Path's are not recognized using the aws-iam-authenticator plugin, by stripping any IAM Paths in the role arn used by worker nodes.
This issue has since been fixed by AWS and IAM Paths are now properly recognized in the aws-auth ConfigMap for EKS clusters. However, even though the role arn with the stripped IAM Path is still usable by the worker nodes, the EKS API does not recognize them and thinks the cluster is in a degraded state.
This results in the nodes showing a Degraded status and EKS does not allow their configuration to be changed/updated (changing ASG settings, for instance).
Proposed Changes
This terraform module needs the ability to manage the aws-auth ConfigMap in order to add a role mapping for management by the StreamNative Control Plane.
We should bring this functionality native to our module, which will:
Enable us to upgrade to newer versions of the EKS parent module (>= v18.X.X)
Remove the custom logic used in versions <= v17.X.X that removes IAM Paths from the worker node role ARN
The text was updated successfully, but these errors were encountered:
Problem Summary
This Terraform module relies on an parent module for the creation of an EKS cluster. Starting with
v18.0.0
, the module no longer supports management of theaws-auth
ConfigMap.In order for us to stay up to date with the EKS parent module, an alternative method of managing the
aws-auth
ConfigMap is necessary.In addition to this issue, versions <=
v17.X.X
of the EKS parent module address an issue where IAM Path's are not recognized using theaws-iam-authenticator
plugin, by stripping any IAM Paths in the role arn used by worker nodes.This issue has since been fixed by AWS and IAM Paths are now properly recognized in the
aws-auth
ConfigMap for EKS clusters. However, even though the role arn with the stripped IAM Path is still usable by the worker nodes, the EKS API does not recognize them and thinks the cluster is in a degraded state.This results in the nodes showing a
Degraded
status and EKS does not allow their configuration to be changed/updated (changing ASG settings, for instance).Proposed Changes
This terraform module needs the ability to manage the
aws-auth
ConfigMap in order to add a role mapping for management by the StreamNative Control Plane.We should bring this functionality native to our module, which will:
v18.X.X
)v17.X.X
that removes IAM Paths from the worker node role ARNThe text was updated successfully, but these errors were encountered: