Skip to content

feat: Support EKS Auto Mode custom node pools only creation #3514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 16, 2025
+113 −58
Merged

feat: Support EKS Auto Mode custom node pools only creation #3514

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 33 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,35 @@ module "eks" {
}
```

### EKS Auto Mode - Custom Node Pools Only

```hcl
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 21.0"

name = "example"
kubernetes_version = "1.33"

# Optional
endpoint_public_access = true

# Optional: Adds the current caller identity as an administrator via cluster access entry
enable_cluster_creator_admin_permissions = true

# Create just the IAM resources for EKS Auto Mode for use with custom node pools
create_auto_mode_iam_resources = true
Comment on lines +76 to +77
Copy link
Contributor

@lorengordon lorengordon Sep 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't quite enough. It is still necessary to enable auto mode, in order to use custom node pools with auto mode...

  compute_config = {
    enabled    = true
    node_pools = []
  }


vpc_id = "vpc-1234556abcdef"
subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]

tags = {
Environment = "dev"
Terraform = "true"
}
}
```

### EKS Managed Node Group

```hcl
Expand Down Expand Up @@ -318,15 +347,15 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9 |
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 4.0 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |
| <a name="provider_time"></a> [time](#provider\_time) | >= 0.9 |
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 4.0 |

Expand Down Expand Up @@ -393,9 +422,10 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
| <a name="input_cloudwatch_log_group_retention_in_days"></a> [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days | `number` | `90` | no |
| <a name="input_cloudwatch_log_group_tags"></a> [cloudwatch\_log\_group\_tags](#input\_cloudwatch\_log\_group\_tags) | A map of additional tags to add to the cloudwatch log group created | `map(string)` | `{}` | no |
| <a name="input_cluster_tags"></a> [cluster\_tags](#input\_cluster\_tags) | A map of additional tags to add to the cluster | `map(string)` | `{}` | no |
| <a name="input_compute_config"></a> [compute\_config](#input\_compute\_config) | Configuration block for the cluster compute configuration | <pre>object({<br/> enabled = optional(bool, false)<br/> node_pools = optional(list(string))<br/> node_role_arn = optional(string)<br/> })</pre> | `null` | no |
| <a name="input_compute_config"></a> [compute\_config](#input\_compute\_config) | Configuration block for the cluster compute configuration | <pre>object({<br/> enabled = optional(bool, false)<br/> node_pools = optional(list(string))<br/> node_role_arn = optional(string)<br/> })</pre> | `{}` | no |
| <a name="input_control_plane_subnet_ids"></a> [control\_plane\_subnet\_ids](#input\_control\_plane\_subnet\_ids) | A list of subnet IDs where the EKS cluster control plane (ENIs) will be provisioned. Used for expanding the pool of subnets used by nodes/node groups without replacing the EKS control plane | `list(string)` | `[]` | no |
| <a name="input_create"></a> [create](#input\_create) | Controls if resources should be created (affects nearly all resources) | `bool` | `true` | no |
| <a name="input_create_auto_mode_iam_resources"></a> [create\_auto\_mode\_iam\_resources](#input\_create\_auto\_mode\_iam\_resources) | Determines whether to create/attach IAM resources for EKS Auto Mode. Useful for when using only custom node pools and not built-in EKS Auto Mode node pools | `bool` | `false` | no |
| <a name="input_create_cloudwatch_log_group"></a> [create\_cloudwatch\_log\_group](#input\_create\_cloudwatch\_log\_group) | Determines whether a log group is created by this module for the cluster logs. If not, AWS will automatically create one if logging is enabled | `bool` | `true` | no |
| <a name="input_create_cni_ipv6_iam_policy"></a> [create\_cni\_ipv6\_iam\_policy](#input\_create\_cni\_ipv6\_iam\_policy) | Determines whether to create an [`AmazonEKS_CNI_IPv6_Policy`](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-ipv6-policy) | `bool` | `false` | no |
| <a name="input_create_iam_role"></a> [create\_iam\_role](#input\_create\_iam\_role) | Determines whether an IAM role is created for the cluster | `bool` | `true` | no |
Expand Down
5 changes: 3 additions & 2 deletions examples/eks-auto-mode/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,20 +25,21 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |

## Modules

| Name | Source | Version |
|------|--------|---------|
| <a name="module_disabled_eks"></a> [disabled\_eks](#module\_disabled\_eks) | ../.. | n/a |
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
| <a name="module_eks_auto_custom_node_pools"></a> [eks\_auto\_custom\_node\_pools](#module\_eks\_auto\_custom\_node\_pools) | ../.. | n/a |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |

## Resources
Expand Down
19 changes: 18 additions & 1 deletion examples/eks-auto-mode/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ module "eks" {
name = local.name
kubernetes_version = local.kubernetes_version
endpoint_public_access = true
deletion_protection = true

enable_cluster_creator_admin_permissions = true

Expand All @@ -50,6 +49,24 @@ module "eks" {
tags = local.tags
}

module "eks_auto_custom_node_pools" {
source = "../.."

name = "${local.name}-custom"
kubernetes_version = local.kubernetes_version
endpoint_public_access = true

enable_cluster_creator_admin_permissions = true

# Create just the IAM resources for EKS Auto Mode for use with custom node pools
create_auto_mode_iam_resources = true

vpc_id = module.vpc.vpc_id
subnet_ids = module.vpc.private_subnets

tags = local.tags
}

module "disabled_eks" {
source = "../.."

Expand Down
2 changes: 1 addition & 1 deletion examples/eks-auto-mode/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
}
}
6 changes: 3 additions & 3 deletions examples/eks-hybrid-nodes/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 3.0 |
| <a name="requirement_http"></a> [http](#requirement\_http) | >= 3.4 |
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 2.5 |
Expand All @@ -36,8 +36,8 @@ Note that this example may create resources which cost money. Run `terraform des

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws.remote"></a> [aws.remote](#provider\_aws.remote) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |
| <a name="provider_aws.remote"></a> [aws.remote](#provider\_aws.remote) | >= 6.13 |
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 3.0 |
| <a name="provider_http"></a> [http](#provider\_http) | >= 3.4 |
| <a name="provider_local"></a> [local](#provider\_local) | >= 2.5 |
Expand Down
2 changes: 1 addition & 1 deletion examples/eks-hybrid-nodes/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
helm = {
source = "hashicorp/helm"
Expand Down
2 changes: 1 addition & 1 deletion examples/eks-managed-node-group/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
}
}
6 changes: 3 additions & 3 deletions examples/karpenter/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,15 +94,15 @@ Note that this example may create resources which cost money. Run `terraform des
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 3.0 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws.virginia"></a> [aws.virginia](#provider\_aws.virginia) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |
| <a name="provider_aws.virginia"></a> [aws.virginia](#provider\_aws.virginia) | >= 6.13 |
| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 3.0 |

## Modules
Expand Down
2 changes: 1 addition & 1 deletion examples/karpenter/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
helm = {
source = "hashicorp/helm"
Expand Down
2 changes: 1 addition & 1 deletion examples/self-managed-node-group/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
}
}
26 changes: 13 additions & 13 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ locals {
create_outposts_local_cluster = var.outpost_config != null
enable_encryption_config = var.encryption_config != null && !local.create_outposts_local_cluster

auto_mode_enabled = try(var.compute_config.enabled, false)
create_auto_mode_iam_resources = var.compute_config.enabled || var.create_auto_mode_iam_resources
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can appreciate the logic behind having a separate var to create the auto mode iam resources. If that's the interface you wish to expose, then certainly makes sense.

}

################################################################################
Expand Down Expand Up @@ -58,7 +58,7 @@ resource "aws_eks_cluster" "this" {
}

dynamic "compute_config" {
for_each = var.compute_config != null ? [var.compute_config] : []
for_each = [var.compute_config]

content {
enabled = compute_config.value.enabled
Expand All @@ -81,10 +81,10 @@ resource "aws_eks_cluster" "this" {

content {
dynamic "elastic_load_balancing" {
for_each = local.auto_mode_enabled ? [1] : []
for_each = [var.compute_config]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This approach works also! Just an alternative way to do the same thing I was doing in #3513. :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I think you'll run into an error when var.compute_config == null, which is the default value for the variable. The construct that I used handles that scenario, var.compute_config[*].

Copy link
Contributor

@lorengordon lorengordon Sep 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh I see, that's why you had to change the default to {} and make it un-nullable. Of course that means the blocks will always be present now, even when not using auto mode.


content {
enabled = local.auto_mode_enabled
enabled = elastic_load_balancing.value.enabled
}
}

Expand Down Expand Up @@ -148,11 +148,11 @@ resource "aws_eks_cluster" "this" {
}

dynamic "storage_config" {
for_each = local.auto_mode_enabled ? [1] : []
for_each = [var.compute_config]

content {
block_storage {
enabled = local.auto_mode_enabled
enabled = storage_config.value.enabled
}
}
}
Expand Down Expand Up @@ -476,7 +476,7 @@ locals {
# Standard EKS cluster
eks_standard_iam_role_policies = { for k, v in {
AmazonEKSClusterPolicy = "${local.iam_role_policy_prefix}/AmazonEKSClusterPolicy",
} : k => v if !local.create_outposts_local_cluster && !local.auto_mode_enabled }
} : k => v if !local.create_outposts_local_cluster && !local.create_auto_mode_iam_resources }

# EKS cluster with EKS auto mode enabled
eks_auto_mode_iam_role_policies = { for k, v in {
Expand All @@ -485,12 +485,12 @@ locals {
AmazonEKSBlockStoragePolicy = "${local.iam_role_policy_prefix}/AmazonEKSBlockStoragePolicy"
AmazonEKSLoadBalancingPolicy = "${local.iam_role_policy_prefix}/AmazonEKSLoadBalancingPolicy"
AmazonEKSNetworkingPolicy = "${local.iam_role_policy_prefix}/AmazonEKSNetworkingPolicy"
} : k => v if !local.create_outposts_local_cluster && local.auto_mode_enabled }
} : k => v if !local.create_outposts_local_cluster && local.create_auto_mode_iam_resources }

# EKS local cluster on Outposts
eks_outpost_iam_role_policies = { for k, v in {
AmazonEKSClusterPolicy = "${local.iam_role_policy_prefix}/AmazonEKSLocalOutpostClusterPolicy"
} : k => v if local.create_outposts_local_cluster && !local.auto_mode_enabled }
} : k => v if local.create_outposts_local_cluster && !local.create_auto_mode_iam_resources }
}

data "aws_iam_policy_document" "assume_role_policy" {
Expand Down Expand Up @@ -591,7 +591,7 @@ resource "aws_iam_policy" "cluster_encryption" {
}

data "aws_iam_policy_document" "custom" {
count = local.create_iam_role && local.auto_mode_enabled && var.enable_auto_mode_custom_tags ? 1 : 0
count = local.create_iam_role && local.create_auto_mode_iam_resources && var.enable_auto_mode_custom_tags ? 1 : 0

dynamic "statement" {
for_each = var.enable_auto_mode_custom_tags ? [1] : []
Expand Down Expand Up @@ -725,7 +725,7 @@ data "aws_iam_policy_document" "custom" {
}

resource "aws_iam_policy" "custom" {
count = local.create_iam_role && local.auto_mode_enabled && var.enable_auto_mode_custom_tags ? 1 : 0
count = local.create_iam_role && local.create_auto_mode_iam_resources && var.enable_auto_mode_custom_tags ? 1 : 0

name = var.iam_role_use_name_prefix ? null : local.iam_role_name
name_prefix = var.iam_role_use_name_prefix ? "${local.iam_role_name}-" : null
Expand All @@ -738,7 +738,7 @@ resource "aws_iam_policy" "custom" {
}

resource "aws_iam_role_policy_attachment" "custom" {
count = local.create_iam_role && local.auto_mode_enabled && var.enable_auto_mode_custom_tags ? 1 : 0
count = local.create_iam_role && local.create_auto_mode_iam_resources && var.enable_auto_mode_custom_tags ? 1 : 0

policy_arn = aws_iam_policy.custom[0].arn
role = aws_iam_role.this[0].name
Expand Down Expand Up @@ -875,7 +875,7 @@ resource "aws_eks_identity_provider_config" "this" {
################################################################################

locals {
create_node_iam_role = local.create && var.create_node_iam_role && local.auto_mode_enabled
create_node_iam_role = local.create && var.create_node_iam_role && local.create_auto_mode_iam_resources
node_iam_role_name = coalesce(var.node_iam_role_name, "${var.name}-eks-auto")
}

Expand Down
4 changes: 2 additions & 2 deletions modules/eks-managed-node-group/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,13 +64,13 @@ module "eks_managed_node_group" {
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/eks-managed-node-group/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
}
}
4 changes: 2 additions & 2 deletions modules/fargate-profile/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,13 @@ module "fargate_profile" {
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/fargate-profile/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
}
}
4 changes: 2 additions & 2 deletions modules/hybrid-node-role/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,13 +75,13 @@ module "eks_hybrid_node_role" {
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.9 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.9 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/hybrid-node-role/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 6.9"
version = ">= 6.13"
}
}
}
Loading