Dev 5769/custom cluster admin arn

[ksoviero-liscio]

Description

Motivation and Context

Breaking Changes

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects

• I have executed pre-commit run -a on my pull request

[bryantbiggs]

you shouldn't do this - you should just pass in the intended role via the cluster access entry. this was just a helper utility to make that easier for users to carry over behavior prior to cluster access entries

[bryantbiggs]

just FYI

[ksoviero-liscio]

I totally didn't mean to create this PR, but since I did, @bryantbiggs are you saying to disable enable_cluster_creator_admin_permissions and create an aws_eks_access_entry resource independently of the module, or do you mean something else?

[bryantbiggs]

you can do that, or you can do it through the module like

terraform-aws-eks/tests/eks-managed-node-group/main.tf

Lines 366 to 381 in d2e6262

	access_entries = {
	# One access entry with a policy associated
	ex-single = {
	kubernetes_groups = []
	principal_arn = aws_iam_role.this["single"].arn
	policy_associations = {
	single = {
	policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
	access_scope = {
	namespaces = ["default"]
	type = "namespace"
	}
	}
	}
	}

enable_cluster_creator_admin_permissions is just mimicking the behavior of the past - for folks who rely on Terraform going into the cluster to provision additional resources, this makes that easier. but if you aren't using the same Terraform IAM entity to go into the cluster, don't use enable_cluster_creator_admin_permissions and instead just define those entities and what permissions they should have via access_entries

[ksoviero-liscio]

Oh, I see... That's very helpful, thanks for the help!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.