v4.0.0-rc1 Use AWS API for EKS Access Control

Use new AWS API for EKS Access Control (#206)

Note: this may not be available via the Terraform registry, so source it via

source = "github.com/cloudposse/terraform-aws-eks-cluster?ref=v4.0.0-rc1"

Major Breaking Changes

Warning

This release has major breaking changes and requires significant manual intervention
to upgrade existing clusters. Read the migration document
for more details.

what

• Use the AWS API to manage EKS access controls instead of the aws-auth ConfigMap
• Remove support for creating an extra security group, deprecated in v2
• Add IPv6 service CIDR output
• Update test framework to go v1.21, Kubernetes 1.29, etc.

v3.0.0

Feature/update resolve conflicts @tyu0912 (#192)

what

Updating the addon to use resolve_conflicts_on_create and resolve_conflicts_on_update.

why

Per reference below, resolve_conflicts is deprecated.

references

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon

v2.9.0

Enable configuration values to be passed to addons @Nuru (#191)

notes

This version bumps requirements:

• Terraform must now be >= 1.3
• AWS provider must now be >= 4.46

Even with that, there is still a deprecation warning when using AWS provider v5. We are providing this release at this level for people who are not yet ready to update to AWS provider v5. Most likely the next release will required v5.

what

• Enable configuration values to be passed to addons
• Wait for security group rules to be in place before trying to contact the cluster
• Update test go version and dependencies

why

• Add-ons may need configuration. For example, to run coredns on Fargate, you must pass '{"computeType": "Fargate"}'. Supersedes and closes #181
• Before security group rules are in place, TCP connection to the cluster will be blocked and the connection will fail.
• Supersede and close the following PRs:
  • closes #177
  • closes #178
  • closes #179
  • closes #180
  • closes #182

references

Supersedes and closes #190

v2.8.1

🚀 Enhancements

Update Security Group rules @aknysh (#186)

what

• Update Security Group rules

why

• This module can create an additional Security Group for the EKS cluster for backwards compatibility if you are updating this module to the latest version on existing clusters
• If the cluster was created using an older version of the module, EKS did not create a managed cluster Security Group at the time, and the the cluster Security Group was the additional Security Group
• This additional Security Group is returned from the expression one(aws_eks_cluster.default[*].vpc_config[0].cluster_security_group_id)
• When the module tries to create resource "aws_security_group_rule" "managed_ingress_cidr_blocks" to add the allowed ingress CIDR blocks, the following error is thrown

 Error: [WARN] A duplicate Security Group rule was found on (sg-xxxxxxxxx). This may be
│ a side effect of a now-fixed Terraform issue causing two security groups with
│ identical attributes but different source_security_group_ids to overwrite each
│ other in the state. See https://github.com/hashicorp/terraform/pull/2376 for more
│ information and instructions for recovery. Error: InvalidPermission.Duplicate: the specified rule "peer: 10.222.0.0/16, ALL, ALLOW" already exists
│ 	status code: 400, request id: 7065e36d-ffca-4540-8e43-ed75d94d752e
│
│   with module.eks_cluster.aws_security_group_rule.managed_ingress_cidr_blocks[0],
│   on .terraform/modules/eks_cluster/security-group.tf line 17, in resource "aws_security_group_rule" "managed_ingress_cidr_blocks":
│   17: resource "aws_security_group_rule" "managed_ingress_cidr_blocks" {

• This PR adds a variable managed_security_group_rules_enabled. For the very old clusters (which use the custom SG as the main cluster SG), set the variable to false to not add the SG rules to it (since the SG is the custom SG to which the module adds the same rules anyway)

v2.8.0

Improved dependency configuration @Nuru (#185)

what

• Add addons_depends_on to allow for nodes to be created before addons are applied
• Add cluster_depends_on to allow for networking to be fully provisioned before cluster is created
• Improve internal depends_on clauses
• Fix tflint complaints

why

• Fixes #170
• May improve destruction when network and cluster are provisioned at the same time
• Maintain access if destruction only partly succeeds

Sync github @max-lobur (#184)

Rebuild github dir from the template

v2.7.0

• No changes

v2.6.0

Add cluster_attributes variable to change cluster attribute @asmithdt (#172)

what

• Add cluster_attributes variable to change cluster attribute

why

• If migrating to this module the cluster name may not end with -cluster and it's neccessary to override the name of the resource.

references

• Closes #171

v2.5.0

🐛 Bug Fixes

Better behavior during destroy @Nuru (#169)

what

• Improve behavior during terraform destroy
• Update documentation

why

• Clusters should destroy cleanly, but previously did not
• Documentation referred to old examples, wrong security group

references

• Fixes #161
• Closes #164
• Closes #165

v2.4.0

Custom Ingress rules @IkePCampbell (#162)

what

• Added list of objects, which are Security Rule Ingress Definitions.

why

• Sometimes I need to add security groups to access my EKS workers, such as other EC2 instances on a variety of ports. Same with RDS instances.

references

• Link to any supporting github issues or helpful documentation to add some context (e.g. stackoverflow).
• Use closes #123, if this PR closes a GitHub issue #123

v2.3.2

🐛 Bug Fixes

Exclude only TLS provider version 4.0.0 @Nuru (#160)

what && why

• In #158 we disallowed all TLS provider version >= 4.0.0 due to hashicorp/terraform-provider-tls#244 . In this release we exclude only 4.0.0 exactly because the bug was fixed in 4.0.1.
• Upgrade go test dependencies to current to pick up bug and security fixes.

references

• #158
• hashicorp/terraform-provider-tls#244