Skip to content

Conversation

bryantbiggs
Copy link
Contributor

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No

Description

Allow EKS Auto Mode settings (compute_config / kubernetes_network_config.elastic_load_balancing / storage_config.block_storage ) to be enabled, disabled, and removed from the configuration

Note

When discussing enabling/disabling EKS Auto Mode, this is represented by the following fields, which per the API, all must be either true or false at this time:

   ...
   "kubernetesNetworkConfig": {
       "elasticLoadBalancing": {
           "enabled": false
       }
   },
   "computeConfig": {
       "enabled": false
   },
   "storageConfig": {
       "blockStorage": {
           "enabled": false
       }
   }
   ...

There are a few scenarios where errors are encountered that this PR is intended to resolve

  1. Creating a cluster without Auto Mode specified, followed by an update to disable Auto Mode. Going from nil objects to objects set to enabled = false results in the error InvalidParameterException: The type for cluster update was not provided
  2. Having a cluster with Auto Mode specified as disabled (all enabled fields set to false) and then trying to remove those arguments from your configuration. Again, going from objects set to enabled = false to nil results in the error InvalidParameterException: The type for cluster update was not provided

Previously, when EKS Auto Mode was initially launched (re:Invent 2024), it was not possible to create a cluster with the Auto Mode fields set to false - this resulted in an error. Today, that does not result in an error and is perfectly valid.

This PR now ensures the EKS Auto Mode enabled fields are always populated with either true or false, only issuing the correct cluster update config API call when the appropriate values are changed. See note added here to better understand "only issuing the correct cluster update config API call when the appropriate values are changed". This is an issue caused by 3 arguments across 3 separate fields needing to be updated in unison, but not always requiring an update when "sister" arguments have changed (i.e. - if Auto Mode enabled/disabled has not changed, but compute_config.node_pools has - we only want to supply the computeConfig field in the update cluster config request)

Relations

Closes #40582
Closes #41155
Relates #42483

References

Related issues

Terraform:

Pulumi:

Terraform EKS Module:

Output from Acceptance Testing

% TF_LOG=debug TF_LOG_PATH=/home/bryant-biggs/Documents/terraform-provider-aws/debug.json AWS_PROFILE=default make testacc TESTS=TestAccEKSCluster_ComputeConfig PKG=eks
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 fix/eks-auto-mode-disable 🌿...
TF_ACC=1 go1.24.6 test ./internal/service/eks/... -v -count 1 -parallel 20 -run='TestAccEKSCluster_ComputeConfig'  -timeout 360m -vet=off
2025/09/17 14:20:02 Creating Terraform AWS Provider (SDKv2-style)...
2025/09/17 14:20:02 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccEKSCluster_ComputeConfig_OnCreate
=== PAUSE TestAccEKSCluster_ComputeConfig_OnCreate
=== RUN   TestAccEKSCluster_ComputeConfig_OnUpdate
=== PAUSE TestAccEKSCluster_ComputeConfig_OnUpdate
=== RUN   TestAccEKSCluster_ComputeConfig_ModifyARN
=== PAUSE TestAccEKSCluster_ComputeConfig_ModifyARN
=== RUN   TestAccEKSCluster_ComputeConfig_AddARN
=== PAUSE TestAccEKSCluster_ComputeConfig_AddARN
=== CONT  TestAccEKSCluster_ComputeConfig_OnCreate
=== CONT  TestAccEKSCluster_ComputeConfig_ModifyARN
=== CONT  TestAccEKSCluster_ComputeConfig_AddARN
=== CONT  TestAccEKSCluster_ComputeConfig_OnUpdate
--- PASS: TestAccEKSCluster_ComputeConfig_AddARN (818.64s)
--- PASS: TestAccEKSCluster_ComputeConfig_OnUpdate (956.85s)
--- PASS: TestAccEKSCluster_ComputeConfig_OnCreate (1092.56s)
--- PASS: TestAccEKSCluster_ComputeConfig_ModifyARN (1583.45s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/eks        1583.720s

disabled

Error: updating EKS Cluster (tf-acc-test-4542960997365135908) compute config: operation error EKS: UpdateClusterConfig, https response error StatusCode: 400, RequestID: 96e8e0d8-e66e-4bc0-a20b-aca0b88079e5, InvalidRequestException: No changes needed for EKS Auto Mode configuration provided

Signed-off-by: Bryant Biggs <[email protected]>
@bryantbiggs bryantbiggs requested a review from a team as a code owner September 17, 2025 20:17
Copy link
Contributor

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

  • Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
  • Please see our prioritization guide for additional information on how the maintainers handle prioritization.
  • Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

  • Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
  • Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

@github-actions github-actions bot added needs-triage Waiting for first response or review from a maintainer. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. service/eks Issues and PRs that pertain to the eks service. size/L Managed by automation to categorize the size of a PR. partner Contribution from a partner. labels Sep 17, 2025
@justinretzolk justinretzolk added bug Addresses a defect in current functionality. and removed needs-triage Waiting for first response or review from a maintainer. labels Sep 18, 2025
@ewbankkit ewbankkit self-assigned this Sep 24, 2025
@github-actions github-actions bot added the prioritized Part of the maintainer teams immediate focus. To be addressed within the current quarter. label Sep 24, 2025
@github-actions github-actions bot added the size/XL Managed by automation to categorize the size of a PR. label Sep 24, 2025
@lorengordon
Copy link
Contributor

Was there an update on AWS Govcloud support for EKS Auto Mode? Currently, specifying these blocks breaks EKS Cluster deployments in AWS Govcloud, because Auto Mode is not supported at all...

@bryantbiggs
Copy link
Contributor Author

it is actively being worked on - its not uncommon for API discrepancies across commercial and gov/secret partitions

@lorengordon
Copy link
Contributor

Yes, very aware of the parity issues between commercial and govcloud, as well as the iso partitions. But also quite often the provider takes those deltas into consideration, rather than outright breaking. We've certainly experienced some discrepancies continue on for years.

@bryantbiggs
Copy link
Contributor Author

We've certainly experienced some discrepancies continue on for years.

#44334 (comment)

it is actively being worked on (emphasize mine)

@lorengordon
Copy link
Contributor

it is actively being worked on (emphasize mine)

I take the hint. And sorry to press, but I am very close to this issue, and do have ongoing work across all partitions. Would you be able to clarify if that work is specifically only for govcloud? Or is it also the iso and iso-b partitions (as frequently they tend to lag even more)? If only govcloud, are the provider maintainers ok with breaking EKS support in subsequent provider versions for iso and iso-b until auto mode is delivered there also?

@bryantbiggs
Copy link
Contributor Author

Its unfortunately not my place to comment on pending releases, but I would suggest reaching out to your AWS reps to get the info through the proper channels

@lorengordon
Copy link
Contributor

I would suggest reaching out to your AWS reps to get the info through the proper channels

They never offer any info about releases either. At least, nothing accurate or dependable. Sigh. This is gonna be a mess.

@bryantbiggs
Copy link
Contributor Author

the comment that these APIs do not work at all in gov/secret partitions seems to be not wholly accurate. The kubernetes_network_config.elastic_load_balancing field has always been a computed field from day 1 of being in the provider

"elastic_load_balancing": {
Type: schema.TypeList,
Optional: true,
Computed: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
names.AttrEnabled: {
Type: schema.TypeBool,
Optional: true,
},
},
},
},
which means that req/res works and its part of the EKS Auto Mode API. Now can you enable Auto Mode in those partitions - no. But I would expect you can set the following without issue:

   ...
   "kubernetesNetworkConfig": {
       "elasticLoadBalancing": {
           "enabled": false
       }
   },
   "computeConfig": {
       "enabled": false
   },
   "storageConfig": {
       "blockStorage": {
           "enabled": false
       }
   }
   ...

But I don't have access to those partitions to test

@lorengordon
Copy link
Contributor

lorengordon commented Sep 24, 2025

From an up-to-date clone of terraform-aws-modules/terraform-aws-eks, with just this diff:

diff --git i/examples/eks-auto-mode/main.tf w/examples/eks-auto-mode/main.tf
index 05eec9b..275ef66 100644
--- i/examples/eks-auto-mode/main.tf
+++ w/examples/eks-auto-mode/main.tf
@@ -13,7 +13,7 @@ data "aws_availability_zones" "available" {
 locals {
   name               = "ex-${basename(path.cwd)}"
   kubernetes_version = "1.33"
-  region             = "us-west-2"
+  region             = "us-gov-west-1"

   vpc_cidr = "10.0.0.0/16"
   azs      = slice(data.aws_availability_zones.available.names, 0, 3)
@@ -39,8 +39,7 @@ module "eks" {
   enable_cluster_creator_admin_permissions = true

   compute_config = {
-    enabled    = true
-    node_pools = ["general-purpose"]
+    enabled    = false
   }

   vpc_id     = module.vpc.vpc_id

Demonstrating the credential access:

❯ aws sts get-caller-identity
{
    "UserId": "AROASYGNMHHREDACTED",
    "Account": "REDACTED",
    "Arn": "arn:aws-us-gov:sts::REDACTED:assumed-role/REDACTED"
}

You get a successful apply of examples/eks-auto-mode, and then a persistent, irreconcilable diff on every subsequent plan:

  # module.eks.aws_eks_cluster.this[0] will be updated in-place
  ~ resource "aws_eks_cluster" "this" {
        id                            = "ex-eks-auto-mode"
        name                          = "ex-eks-auto-mode"
        tags                          = {
            "GithubOrg"             = "terraform-aws-modules"
            "GithubRepo"            = "terraform-aws-eks"
            "Test"                  = "ex-eks-auto-mode"
            "terraform-aws-modules" = "eks"
        }
        # (14 unchanged attributes hidden)

      + compute_config {
          + enabled = false
        }

      ~ kubernetes_network_config {
            # (3 unchanged attributes hidden)

          + elastic_load_balancing {
              + enabled = false
            }
        }

      + storage_config {
          + block_storage {
              + enabled = false
            }
        }

        # (4 unchanged blocks hidden)
    }

Copy link
Contributor

@ewbankkit ewbankkit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀.

% ACCTEST_TIMEOUT=720m make testacc TESTARGS='-run=TestAccEKSCluster_' PKG=eks ACCTEST_PARALLELISM=4
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 HEAD 🌿...
TF_ACC=1 go1.24.6 test ./internal/service/eks/... -v -count 1 -parallel 4  -run=TestAccEKSCluster_ -timeout 720m -vet=off
2025/09/24 12:22:18 Creating Terraform AWS Provider (SDKv2-style)...
2025/09/24 12:22:18 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccEKSCluster_basic
=== PAUSE TestAccEKSCluster_basic
=== RUN   TestAccEKSCluster_disappears
=== PAUSE TestAccEKSCluster_disappears
=== RUN   TestAccEKSCluster_AccessConfig_create
=== PAUSE TestAccEKSCluster_AccessConfig_create
=== RUN   TestAccEKSCluster_AccessConfig_update
=== PAUSE TestAccEKSCluster_AccessConfig_update
=== RUN   TestAccEKSCluster_BootstrapSelfManagedAddons_update
=== PAUSE TestAccEKSCluster_BootstrapSelfManagedAddons_update
=== RUN   TestAccEKSCluster_BootstrapSelfManagedAddons_migrate
=== PAUSE TestAccEKSCluster_BootstrapSelfManagedAddons_migrate
=== RUN   TestAccEKSCluster_ComputeConfig_OnCreate
=== PAUSE TestAccEKSCluster_ComputeConfig_OnCreate
=== RUN   TestAccEKSCluster_ComputeConfig_OnUpdate
=== PAUSE TestAccEKSCluster_ComputeConfig_OnUpdate
=== RUN   TestAccEKSCluster_ComputeConfig_ModifyARN
=== PAUSE TestAccEKSCluster_ComputeConfig_ModifyARN
=== RUN   TestAccEKSCluster_ComputeConfig_AddARN
=== PAUSE TestAccEKSCluster_ComputeConfig_AddARN
=== RUN   TestAccEKSCluster_Encryption_create
=== PAUSE TestAccEKSCluster_Encryption_create
=== RUN   TestAccEKSCluster_Encryption_update
=== PAUSE TestAccEKSCluster_Encryption_update
=== RUN   TestAccEKSCluster_Encryption_versionUpdate
=== PAUSE TestAccEKSCluster_Encryption_versionUpdate
=== RUN   TestAccEKSCluster_forceUpdateVersion
=== PAUSE TestAccEKSCluster_forceUpdateVersion
=== RUN   TestAccEKSCluster_version
=== PAUSE TestAccEKSCluster_version
=== RUN   TestAccEKSCluster_logging
=== PAUSE TestAccEKSCluster_logging
=== RUN   TestAccEKSCluster_tags
=== PAUSE TestAccEKSCluster_tags
=== RUN   TestAccEKSCluster_VPC_securityGroupIDs
=== PAUSE TestAccEKSCluster_VPC_securityGroupIDs
=== RUN   TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update
=== PAUSE TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update
=== RUN   TestAccEKSCluster_VPC_endpointPrivateAccess
=== PAUSE TestAccEKSCluster_VPC_endpointPrivateAccess
=== RUN   TestAccEKSCluster_VPC_endpointPublicAccess
=== PAUSE TestAccEKSCluster_VPC_endpointPublicAccess
=== RUN   TestAccEKSCluster_VPC_publicAccessCIDRs
=== PAUSE TestAccEKSCluster_VPC_publicAccessCIDRs
=== RUN   TestAccEKSCluster_Network_serviceIPv4CIDR
=== PAUSE TestAccEKSCluster_Network_serviceIPv4CIDR
=== RUN   TestAccEKSCluster_Network_ipFamily
=== PAUSE TestAccEKSCluster_Network_ipFamily
=== RUN   TestAccEKSCluster_Outpost_create
=== PAUSE TestAccEKSCluster_Outpost_create
=== RUN   TestAccEKSCluster_Outpost_placement
=== PAUSE TestAccEKSCluster_Outpost_placement
=== RUN   TestAccEKSCluster_RemoteNetwork_Node_OnCreate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Node_OnCreate
=== RUN   TestAccEKSCluster_RemoteNetwork_Node_OnUpdate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Node_OnUpdate
=== RUN   TestAccEKSCluster_RemoteNetwork_Pod_OnCreate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Pod_OnCreate
=== RUN   TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate
=== RUN   TestAccEKSCluster_upgradePolicy
=== PAUSE TestAccEKSCluster_upgradePolicy
=== RUN   TestAccEKSCluster_zonalShiftConfig
=== PAUSE TestAccEKSCluster_zonalShiftConfig
=== RUN   TestAccEKSCluster_deletionProtection
=== PAUSE TestAccEKSCluster_deletionProtection
=== CONT  TestAccEKSCluster_basic
=== CONT  TestAccEKSCluster_VPC_securityGroupIDs
=== CONT  TestAccEKSCluster_ComputeConfig_AddARN
=== CONT  TestAccEKSCluster_forceUpdateVersion
--- PASS: TestAccEKSCluster_VPC_securityGroupIDs (603.68s)
=== CONT  TestAccEKSCluster_tags
--- PASS: TestAccEKSCluster_basic (565.93s)
=== CONT  TestAccEKSCluster_logging
--- PASS: TestAccEKSCluster_ComputeConfig_AddARN (993.64s)
=== CONT  TestAccEKSCluster_version
--- PASS: TestAccEKSCluster_tags (584.04s)
=== CONT  TestAccEKSCluster_BootstrapSelfManagedAddons_migrate
=== CONT  TestAccEKSCluster_ComputeConfig_ModifyARN
--- PASS: TestAccEKSCluster_BootstrapSelfManagedAddons_migrate (583.44s)
--- PASS: TestAccEKSCluster_forceUpdateVersion (1192.59s)
=== CONT  TestAccEKSCluster_ComputeConfig_OnUpdate
--- PASS: TestAccEKSCluster_logging (841.77s)
=== CONT  TestAccEKSCluster_ComputeConfig_OnCreate
--- PASS: TestAccEKSCluster_ComputeConfig_OnUpdate (821.22s)
=== CONT  TestAccEKSCluster_AccessConfig_update
--- PASS: TestAccEKSCluster_version (1085.83s)
=== CONT  TestAccEKSCluster_BootstrapSelfManagedAddons_update
--- PASS: TestAccEKSCluster_ComputeConfig_OnCreate (700.43s)
=== CONT  TestAccEKSCluster_Encryption_update
--- PASS: TestAccEKSCluster_AccessConfig_update (637.01s)
=== CONT  TestAccEKSCluster_Encryption_versionUpdate
--- PASS: TestAccEKSCluster_BootstrapSelfManagedAddons_update (921.95s)
=== CONT  TestAccEKSCluster_AccessConfig_create
--- PASS: TestAccEKSCluster_ComputeConfig_ModifyARN (2119.41s)
=== CONT  TestAccEKSCluster_disappears
--- PASS: TestAccEKSCluster_Encryption_update (1154.65s)
=== CONT  TestAccEKSCluster_VPC_publicAccessCIDRs
--- PASS: TestAccEKSCluster_Encryption_versionUpdate (805.25s)
=== CONT  TestAccEKSCluster_Outpost_create
    cluster_test.go:1289: skipping since no Outposts found
--- SKIP: TestAccEKSCluster_Outpost_create (0.58s)
=== CONT  TestAccEKSCluster_Network_ipFamily
--- PASS: TestAccEKSCluster_AccessConfig_create (549.28s)
=== CONT  TestAccEKSCluster_Network_serviceIPv4CIDR
--- PASS: TestAccEKSCluster_disappears (521.18s)
=== CONT  TestAccEKSCluster_Encryption_create
--- PASS: TestAccEKSCluster_VPC_publicAccessCIDRs (1042.14s)
=== CONT  TestAccEKSCluster_VPC_endpointPrivateAccess
--- PASS: TestAccEKSCluster_Encryption_create (560.19s)
=== CONT  TestAccEKSCluster_VPC_endpointPublicAccess
--- PASS: TestAccEKSCluster_Network_serviceIPv4CIDR (1139.16s)
=== CONT  TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate
--- PASS: TestAccEKSCluster_Network_ipFamily (1254.34s)
=== CONT  TestAccEKSCluster_deletionProtection
--- PASS: TestAccEKSCluster_deletionProtection (522.10s)
=== CONT  TestAccEKSCluster_zonalShiftConfig
--- PASS: TestAccEKSCluster_VPC_endpointPublicAccess (1263.95s)
=== CONT  TestAccEKSCluster_upgradePolicy
--- PASS: TestAccEKSCluster_zonalShiftConfig (637.21s)
=== CONT  TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update
--- PASS: TestAccEKSCluster_VPC_endpointPrivateAccess (1632.43s)
=== CONT  TestAccEKSCluster_RemoteNetwork_Node_OnUpdate
--- PASS: TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate (1342.87s)
=== CONT  TestAccEKSCluster_RemoteNetwork_Pod_OnCreate
--- PASS: TestAccEKSCluster_upgradePolicy (580.88s)
=== CONT  TestAccEKSCluster_RemoteNetwork_Node_OnCreate
--- PASS: TestAccEKSCluster_RemoteNetwork_Pod_OnCreate (646.22s)
=== CONT  TestAccEKSCluster_Outpost_placement
    cluster_test.go:1322: skipping since no Outposts found
--- SKIP: TestAccEKSCluster_Outpost_placement (0.43s)
--- PASS: TestAccEKSCluster_RemoteNetwork_Node_OnCreate (532.82s)
--- PASS: TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update (1404.80s)
--- PASS: TestAccEKSCluster_RemoteNetwork_Node_OnUpdate (1378.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/eks	7369.170s

Copy link
Member

@johnsonaj johnsonaj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@ewbankkit
Copy link
Contributor

@bryantbiggs Thanks for the contribution 🎉 👏.

@ewbankkit ewbankkit merged commit aa9eaae into hashicorp:main Sep 24, 2025
37 checks passed
Copy link
Contributor

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

@github-actions github-actions bot added this to the v6.15.0 milestone Sep 24, 2025
@bryantbiggs bryantbiggs deleted the fix/eks-auto-mode-disable branch September 24, 2025 20:15
@github-actions github-actions bot removed the prioritized Part of the maintainer teams immediate focus. To be addressed within the current quarter. label Oct 2, 2025
Copy link
Contributor

github-actions bot commented Oct 2, 2025

This functionality has been released in v6.15.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

@tculp
Copy link

tculp commented Oct 3, 2025

@bryantbiggs I can confirm the behavior demonstrated by @lorengordon

Using:

  • provider version v6.15.0
  • terraform-aws-eks module v21.3.1
  • us-gov-east-1 region

I get the same irreconcilable diff on every apply

@lorengordon
Copy link
Contributor

@tculp It will be like that in all aws partitions that do not support EKS Auto Mode. Including aws-cn, iso, iso-b, etc. And for now anyway, aws-us-gov. If you have a chance, I strongly recommend opening a new issue with the details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Addresses a defect in current functionality. partner Contribution from a partner. service/eks Issues and PRs that pertain to the eks service. size/L Managed by automation to categorize the size of a PR. size/XL Managed by automation to categorize the size of a PR. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: Disabling EKS Auto Mode causes failure
6 participants