-
Notifications
You must be signed in to change notification settings - Fork 9.7k
fix: Allow EKS Auto Mode settings to be enabled, disabled, and removed from the configuration #44334
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Allow EKS Auto Mode settings to be enabled, disabled, and removed from the configuration #44334
Conversation
disabled Error: updating EKS Cluster (tf-acc-test-4542960997365135908) compute config: operation error EKS: UpdateClusterConfig, https response error StatusCode: 400, RequestID: 96e8e0d8-e66e-4bc0-a20b-aca0b88079e5, InvalidRequestException: No changes needed for EKS Auto Mode configuration provided Signed-off-by: Bryant Biggs <[email protected]>
Community GuidelinesThis comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀 Voting for Prioritization
Pull Request Authors
|
Was there an update on AWS Govcloud support for EKS Auto Mode? Currently, specifying these blocks breaks EKS Cluster deployments in AWS Govcloud, because Auto Mode is not supported at all... |
it is actively being worked on - its not uncommon for API discrepancies across commercial and gov/secret partitions |
Yes, very aware of the parity issues between commercial and govcloud, as well as the iso partitions. But also quite often the provider takes those deltas into consideration, rather than outright breaking. We've certainly experienced some discrepancies continue on for years. |
it is actively being worked on (emphasize mine) |
I take the hint. And sorry to press, but I am very close to this issue, and do have ongoing work across all partitions. Would you be able to clarify if that work is specifically only for govcloud? Or is it also the iso and iso-b partitions (as frequently they tend to lag even more)? If only govcloud, are the provider maintainers ok with breaking EKS support in subsequent provider versions for iso and iso-b until auto mode is delivered there also? |
Its unfortunately not my place to comment on pending releases, but I would suggest reaching out to your AWS reps to get the info through the proper channels |
They never offer any info about releases either. At least, nothing accurate or dependable. Sigh. This is gonna be a mess. |
the comment that these APIs do not work at all in gov/secret partitions seems to be not wholly accurate. The terraform-provider-aws/internal/service/eks/cluster.go Lines 263 to 276 in 71008b5
...
"kubernetesNetworkConfig": {
"elasticLoadBalancing": {
"enabled": false
}
},
"computeConfig": {
"enabled": false
},
"storageConfig": {
"blockStorage": {
"enabled": false
}
}
... But I don't have access to those partitions to test |
From an up-to-date clone of terraform-aws-modules/terraform-aws-eks, with just this diff: diff --git i/examples/eks-auto-mode/main.tf w/examples/eks-auto-mode/main.tf
index 05eec9b..275ef66 100644
--- i/examples/eks-auto-mode/main.tf
+++ w/examples/eks-auto-mode/main.tf
@@ -13,7 +13,7 @@ data "aws_availability_zones" "available" {
locals {
name = "ex-${basename(path.cwd)}"
kubernetes_version = "1.33"
- region = "us-west-2"
+ region = "us-gov-west-1"
vpc_cidr = "10.0.0.0/16"
azs = slice(data.aws_availability_zones.available.names, 0, 3)
@@ -39,8 +39,7 @@ module "eks" {
enable_cluster_creator_admin_permissions = true
compute_config = {
- enabled = true
- node_pools = ["general-purpose"]
+ enabled = false
}
vpc_id = module.vpc.vpc_id Demonstrating the credential access:
You get a successful apply of
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🚀.
% ACCTEST_TIMEOUT=720m make testacc TESTARGS='-run=TestAccEKSCluster_' PKG=eks ACCTEST_PARALLELISM=4
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 HEAD 🌿...
TF_ACC=1 go1.24.6 test ./internal/service/eks/... -v -count 1 -parallel 4 -run=TestAccEKSCluster_ -timeout 720m -vet=off
2025/09/24 12:22:18 Creating Terraform AWS Provider (SDKv2-style)...
2025/09/24 12:22:18 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN TestAccEKSCluster_basic
=== PAUSE TestAccEKSCluster_basic
=== RUN TestAccEKSCluster_disappears
=== PAUSE TestAccEKSCluster_disappears
=== RUN TestAccEKSCluster_AccessConfig_create
=== PAUSE TestAccEKSCluster_AccessConfig_create
=== RUN TestAccEKSCluster_AccessConfig_update
=== PAUSE TestAccEKSCluster_AccessConfig_update
=== RUN TestAccEKSCluster_BootstrapSelfManagedAddons_update
=== PAUSE TestAccEKSCluster_BootstrapSelfManagedAddons_update
=== RUN TestAccEKSCluster_BootstrapSelfManagedAddons_migrate
=== PAUSE TestAccEKSCluster_BootstrapSelfManagedAddons_migrate
=== RUN TestAccEKSCluster_ComputeConfig_OnCreate
=== PAUSE TestAccEKSCluster_ComputeConfig_OnCreate
=== RUN TestAccEKSCluster_ComputeConfig_OnUpdate
=== PAUSE TestAccEKSCluster_ComputeConfig_OnUpdate
=== RUN TestAccEKSCluster_ComputeConfig_ModifyARN
=== PAUSE TestAccEKSCluster_ComputeConfig_ModifyARN
=== RUN TestAccEKSCluster_ComputeConfig_AddARN
=== PAUSE TestAccEKSCluster_ComputeConfig_AddARN
=== RUN TestAccEKSCluster_Encryption_create
=== PAUSE TestAccEKSCluster_Encryption_create
=== RUN TestAccEKSCluster_Encryption_update
=== PAUSE TestAccEKSCluster_Encryption_update
=== RUN TestAccEKSCluster_Encryption_versionUpdate
=== PAUSE TestAccEKSCluster_Encryption_versionUpdate
=== RUN TestAccEKSCluster_forceUpdateVersion
=== PAUSE TestAccEKSCluster_forceUpdateVersion
=== RUN TestAccEKSCluster_version
=== PAUSE TestAccEKSCluster_version
=== RUN TestAccEKSCluster_logging
=== PAUSE TestAccEKSCluster_logging
=== RUN TestAccEKSCluster_tags
=== PAUSE TestAccEKSCluster_tags
=== RUN TestAccEKSCluster_VPC_securityGroupIDs
=== PAUSE TestAccEKSCluster_VPC_securityGroupIDs
=== RUN TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update
=== PAUSE TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update
=== RUN TestAccEKSCluster_VPC_endpointPrivateAccess
=== PAUSE TestAccEKSCluster_VPC_endpointPrivateAccess
=== RUN TestAccEKSCluster_VPC_endpointPublicAccess
=== PAUSE TestAccEKSCluster_VPC_endpointPublicAccess
=== RUN TestAccEKSCluster_VPC_publicAccessCIDRs
=== PAUSE TestAccEKSCluster_VPC_publicAccessCIDRs
=== RUN TestAccEKSCluster_Network_serviceIPv4CIDR
=== PAUSE TestAccEKSCluster_Network_serviceIPv4CIDR
=== RUN TestAccEKSCluster_Network_ipFamily
=== PAUSE TestAccEKSCluster_Network_ipFamily
=== RUN TestAccEKSCluster_Outpost_create
=== PAUSE TestAccEKSCluster_Outpost_create
=== RUN TestAccEKSCluster_Outpost_placement
=== PAUSE TestAccEKSCluster_Outpost_placement
=== RUN TestAccEKSCluster_RemoteNetwork_Node_OnCreate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Node_OnCreate
=== RUN TestAccEKSCluster_RemoteNetwork_Node_OnUpdate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Node_OnUpdate
=== RUN TestAccEKSCluster_RemoteNetwork_Pod_OnCreate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Pod_OnCreate
=== RUN TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate
=== PAUSE TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate
=== RUN TestAccEKSCluster_upgradePolicy
=== PAUSE TestAccEKSCluster_upgradePolicy
=== RUN TestAccEKSCluster_zonalShiftConfig
=== PAUSE TestAccEKSCluster_zonalShiftConfig
=== RUN TestAccEKSCluster_deletionProtection
=== PAUSE TestAccEKSCluster_deletionProtection
=== CONT TestAccEKSCluster_basic
=== CONT TestAccEKSCluster_VPC_securityGroupIDs
=== CONT TestAccEKSCluster_ComputeConfig_AddARN
=== CONT TestAccEKSCluster_forceUpdateVersion
--- PASS: TestAccEKSCluster_VPC_securityGroupIDs (603.68s)
=== CONT TestAccEKSCluster_tags
--- PASS: TestAccEKSCluster_basic (565.93s)
=== CONT TestAccEKSCluster_logging
--- PASS: TestAccEKSCluster_ComputeConfig_AddARN (993.64s)
=== CONT TestAccEKSCluster_version
--- PASS: TestAccEKSCluster_tags (584.04s)
=== CONT TestAccEKSCluster_BootstrapSelfManagedAddons_migrate
=== CONT TestAccEKSCluster_ComputeConfig_ModifyARN
--- PASS: TestAccEKSCluster_BootstrapSelfManagedAddons_migrate (583.44s)
--- PASS: TestAccEKSCluster_forceUpdateVersion (1192.59s)
=== CONT TestAccEKSCluster_ComputeConfig_OnUpdate
--- PASS: TestAccEKSCluster_logging (841.77s)
=== CONT TestAccEKSCluster_ComputeConfig_OnCreate
--- PASS: TestAccEKSCluster_ComputeConfig_OnUpdate (821.22s)
=== CONT TestAccEKSCluster_AccessConfig_update
--- PASS: TestAccEKSCluster_version (1085.83s)
=== CONT TestAccEKSCluster_BootstrapSelfManagedAddons_update
--- PASS: TestAccEKSCluster_ComputeConfig_OnCreate (700.43s)
=== CONT TestAccEKSCluster_Encryption_update
--- PASS: TestAccEKSCluster_AccessConfig_update (637.01s)
=== CONT TestAccEKSCluster_Encryption_versionUpdate
--- PASS: TestAccEKSCluster_BootstrapSelfManagedAddons_update (921.95s)
=== CONT TestAccEKSCluster_AccessConfig_create
--- PASS: TestAccEKSCluster_ComputeConfig_ModifyARN (2119.41s)
=== CONT TestAccEKSCluster_disappears
--- PASS: TestAccEKSCluster_Encryption_update (1154.65s)
=== CONT TestAccEKSCluster_VPC_publicAccessCIDRs
--- PASS: TestAccEKSCluster_Encryption_versionUpdate (805.25s)
=== CONT TestAccEKSCluster_Outpost_create
cluster_test.go:1289: skipping since no Outposts found
--- SKIP: TestAccEKSCluster_Outpost_create (0.58s)
=== CONT TestAccEKSCluster_Network_ipFamily
--- PASS: TestAccEKSCluster_AccessConfig_create (549.28s)
=== CONT TestAccEKSCluster_Network_serviceIPv4CIDR
--- PASS: TestAccEKSCluster_disappears (521.18s)
=== CONT TestAccEKSCluster_Encryption_create
--- PASS: TestAccEKSCluster_VPC_publicAccessCIDRs (1042.14s)
=== CONT TestAccEKSCluster_VPC_endpointPrivateAccess
--- PASS: TestAccEKSCluster_Encryption_create (560.19s)
=== CONT TestAccEKSCluster_VPC_endpointPublicAccess
--- PASS: TestAccEKSCluster_Network_serviceIPv4CIDR (1139.16s)
=== CONT TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate
--- PASS: TestAccEKSCluster_Network_ipFamily (1254.34s)
=== CONT TestAccEKSCluster_deletionProtection
--- PASS: TestAccEKSCluster_deletionProtection (522.10s)
=== CONT TestAccEKSCluster_zonalShiftConfig
--- PASS: TestAccEKSCluster_VPC_endpointPublicAccess (1263.95s)
=== CONT TestAccEKSCluster_upgradePolicy
--- PASS: TestAccEKSCluster_zonalShiftConfig (637.21s)
=== CONT TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update
--- PASS: TestAccEKSCluster_VPC_endpointPrivateAccess (1632.43s)
=== CONT TestAccEKSCluster_RemoteNetwork_Node_OnUpdate
--- PASS: TestAccEKSCluster_RemoteNetwork_Pod_OnUpdate (1342.87s)
=== CONT TestAccEKSCluster_RemoteNetwork_Pod_OnCreate
--- PASS: TestAccEKSCluster_upgradePolicy (580.88s)
=== CONT TestAccEKSCluster_RemoteNetwork_Node_OnCreate
--- PASS: TestAccEKSCluster_RemoteNetwork_Pod_OnCreate (646.22s)
=== CONT TestAccEKSCluster_Outpost_placement
cluster_test.go:1322: skipping since no Outposts found
--- SKIP: TestAccEKSCluster_Outpost_placement (0.43s)
--- PASS: TestAccEKSCluster_RemoteNetwork_Node_OnCreate (532.82s)
--- PASS: TestAccEKSCluster_VPC_securityGroupIDsAndSubnetIDs_update (1404.80s)
--- PASS: TestAccEKSCluster_RemoteNetwork_Node_OnUpdate (1378.59s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/eks 7369.170s
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🚀
@bryantbiggs Thanks for the contribution 🎉 👏. |
Warning This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them. Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed. |
This functionality has been released in v6.15.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you! |
@bryantbiggs I can confirm the behavior demonstrated by @lorengordon Using:
I get the same irreconcilable diff on every apply |
@tculp It will be like that in all aws partitions that do not support EKS Auto Mode. Including aws-cn, iso, iso-b, etc. And for now anyway, aws-us-gov. If you have a chance, I strongly recommend opening a new issue with the details. |
Rollback Plan
If a change needs to be reverted, we will publish an updated version of the library.
Changes to Security Controls
No
Description
Allow EKS Auto Mode settings (
compute_config
/kubernetes_network_config.elastic_load_balancing
/storage_config.block_storage
) to be enabled, disabled, and removed from the configurationNote
When discussing enabling/disabling EKS Auto Mode, this is represented by the following fields, which per the API, all must be either
true
orfalse
at this time:There are a few scenarios where errors are encountered that this PR is intended to resolve
nil
objects to objects set toenabled = false
results in the errorInvalidParameterException: The type for cluster update was not provided
enabled
fields set tofalse
) and then trying to remove those arguments from your configuration. Again, going from objects set toenabled = false
tonil
results in the errorInvalidParameterException: The type for cluster update was not provided
Previously, when EKS Auto Mode was initially launched (re:Invent 2024), it was not possible to create a cluster with the Auto Mode fields set to
false
- this resulted in an error. Today, that does not result in an error and is perfectly valid.This PR now ensures the EKS Auto Mode
enabled
fields are always populated with eithertrue
orfalse
, only issuing the correct cluster update config API call when the appropriate values are changed. See note added here to better understand "only issuing the correct cluster update config API call when the appropriate values are changed". This is an issue caused by 3 arguments across 3 separate fields needing to be updated in unison, but not always requiring an update when "sister" arguments have changed (i.e. - if Auto Mode enabled/disabled has not changed, butcompute_config.node_pools
has - we only want to supply thecomputeConfig
field in the update cluster config request)Relations
Closes #40582
Closes #41155
Relates #42483
References
Related issues
Terraform:
compute_config.node_role_arn
when disabling auto mode or built-in node pools #42483Pulumi:
Terraform EKS Module:
Output from Acceptance Testing