feat: add EKS Auto Mode support

[Benbentwo]

Summary

• Add compute_config, storage_config, and elastic_load_balancing object variables for fully configurable Auto Mode support
• Add dynamic blocks for compute_config, storage_config, and elastic_load_balancing on aws_eks_cluster
• Add sts:TagSession to cluster role trust policy when Auto Mode enabled
• Attach 4 Auto Mode cluster IAM policies (AmazonEKSComputePolicy, AmazonEKSBlockStoragePolicy, AmazonEKSLoadBalancingPolicy, AmazonEKSNetworkingPolicy)
• Add auto_mode_enabled output
• Add consistency check ensuring all three capabilities are toggled together
• Auto-set bootstrap_self_managed_addons = false when Auto Mode is enabled
• Bump AWS provider minimum to >= 5.79.0

All defaults preserve current behavior -- this is additive and non-breaking.

Test plan

• terraform validate passes (verified locally)
• terraform plan on existing cluster shows no changes (backward compat)
• Deploy new cluster with Auto Mode enabled, verify via aws eks describe-cluster
• Verify cluster IAM role has Auto Mode policies attached
• Verify bootstrap_self_managed_addons is correctly auto-set

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f40dcf85-3bd5-4153-88e9-e18b127304d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds comprehensive EKS Auto Mode support to the module by introducing new IAM policy attachments, cluster-level configuration blocks, validation checks, and input variables to control compute, storage, and networking capabilities under Auto Mode, along with an output to expose Auto Mode enablement status.

Changes

Cohort / File(s)	Summary
IAM and Auto Mode Policies iam.tf	Updated EKS service role trust policy to conditionally include sts:TagSession action alongside sts:AssumeRole when Auto Mode is enabled. Added new local auto_mode_cluster_policies that generates AWS-managed policy ARNs for Auto Mode, and a new resource aws_iam_role_policy_attachment.auto_mode to attach these policies to the service role.
Core Cluster Configuration main.tf	Added Auto Mode derived locals computing enablement state for compute, storage, and load balancing features, plus effective bootstrap setting logic. Introduced consistency check ensuring the three feature flags are all enabled or all disabled. Enhanced kubernetes_network_config to conditionally render IPv4 and elastic load balancing blocks. Added dynamic blocks for compute_config and storage_config when respective features are enabled.
Module Interface variables.tf, outputs.tf	Added three new input variables (compute_config, storage_config, elastic_load_balancing) with nested objects to expose Auto Mode configuration options. Updated bootstrap_self_managed_addons_enabled description to document Auto Mode constraints. Added new auto_mode_enabled output exposing the computed Auto Mode enablement state.
Provider Requirement versions.tf	Updated Terraform AWS provider version constraint from >= 5.75.1 to >= 5.79.0 to support new Auto Mode features.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~30 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat: add EKS Auto Mode support' clearly summarizes the main change: adding support for EKS Auto Mode, which is the primary purpose of the pull request.
Description check	✅ Passed	The description provides a comprehensive summary of the changes related to EKS Auto Mode support, including new variables, dynamic blocks, IAM policies, and configuration updates, all directly relevant to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch Benbentwo/eks-auto-mode

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

main.tf (1)

34-39: Consider using precondition for strict enforcement instead of check.

The check block produces a warning but does not prevent the apply. If the intention is to strictly enforce that all three Auto Mode capabilities must be toggled together, a precondition on the aws_eks_cluster resource would block invalid configurations at plan time.

💡 Alternative using precondition for strict enforcement

 resource "aws_eks_cluster" "default" {
   count = local.enabled ? 1 : 0
   # ... existing config ...

+  lifecycle {
+    precondition {
+      condition     = local.auto_mode_all_enabled || local.auto_mode_all_disabled
+      error_message = "compute_config.enabled, storage_config.block_storage.enabled, and elastic_load_balancing.enabled must all be true or all be false."
+    }
+    # existing ignore_changes ...
+  }

Keep the check block if you prefer advisory warnings, or replace with a precondition if strict enforcement is required.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@main.tf` around lines 34 - 39, The current check block using
local.auto_mode_all_enabled / local.auto_mode_all_disabled only emits a warning;
replace or add a precondition on the aws_eks_cluster resource to strictly
enforce the same boolean condition at plan time: add a lifecycle precondition
that asserts (local.auto_mode_all_enabled || local.auto_mode_all_disabled) with
an explanatory error_message referencing the three toggles, and remove or keep
the advisory check as desired; locate the aws_eks_cluster resource and add the
precondition block there using the same condition and message.

variables.tf (1)

209-221: Consider adding validation for node_role_arn when compute is enabled.

When compute_config.enabled = true, AWS requires a node_role_arn. If a user forgets to provide it, the error will come from the AWS API at apply time rather than during validation. Adding a validation block would provide clearer feedback.

💡 Suggested validation

 variable "compute_config" {
   description = <<-EOT
     EKS Auto Mode compute configuration. When enabled, AWS manages node
     provisioning via managed Karpenter.
   EOT
   type = object({
     enabled       = optional(bool, false)
     node_pools    = optional(set(string), ["general-purpose", "system"])
     node_role_arn = optional(string, null)
   })
   default  = {}
   nullable = false
+
+  validation {
+    condition     = !var.compute_config.enabled || var.compute_config.node_role_arn != null
+    error_message = "node_role_arn is required when compute_config.enabled is true."
+  }
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@variables.tf` around lines 209 - 221, The compute_config variable lacks a
validation rule to ensure node_role_arn is provided when compute is enabled; add
a validation block inside the variable "compute_config" that checks if
var.compute_config.enabled is true then var.compute_config.node_role_arn is not
null and not an empty string (or use length(...) > 0), and supply a clear
error_message like "compute_config.node_role_arn must be set when
compute_config.enabled is true"; reference the variable name compute_config and
its attributes enabled and node_role_arn when implementing the validation.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@main.tf`:
- Around line 34-39: The current check block using local.auto_mode_all_enabled /
local.auto_mode_all_disabled only emits a warning; replace or add a precondition
on the aws_eks_cluster resource to strictly enforce the same boolean condition
at plan time: add a lifecycle precondition that asserts
(local.auto_mode_all_enabled || local.auto_mode_all_disabled) with an
explanatory error_message referencing the three toggles, and remove or keep the
advisory check as desired; locate the aws_eks_cluster resource and add the
precondition block there using the same condition and message.

In `@variables.tf`:
- Around line 209-221: The compute_config variable lacks a validation rule to
ensure node_role_arn is provided when compute is enabled; add a validation block
inside the variable "compute_config" that checks if var.compute_config.enabled
is true then var.compute_config.node_role_arn is not null and not an empty
string (or use length(...) > 0), and supply a clear error_message like
"compute_config.node_role_arn must be set when compute_config.enabled is true";
reference the variable name compute_config and its attributes enabled and
node_role_arn when implementing the validation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fee7cc3d-7bbf-4332-a42a-23185990d86c

📥 Commits

Reviewing files that changed from the base of the PR and between 2049cc8 and 7f4d7b3.

📒 Files selected for processing (5)

• iam.tf
• main.tf
• outputs.tf
• variables.tf
• versions.tf

[dudymas]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[github-actions]

These changes were released in v4.9.0.