Releases: terraform-aws-modules/terraform-aws-eks
Releases · terraform-aws-modules/terraform-aws-eks
v20.1.1
v20.1.0
v20.0.1
v20.0.0
20.0.0 (2024-02-02)
⚠ BREAKING CHANGES
- Replace the use of
aws-authconfigmap with EKS cluster access entry (#2858)
See the UPGRADE-20.0.md guide for further details on the changes and guidance for upgrading
List of backwards incompatible changes
- Minium supported AWS provider version increased to
v5.34 - Minimum supported Terraform version increased to
v1.3to support Terraform statemovedblocks as well as other advanced features - The
resolve_conflictsargument within thecluster_addonsconfiguration has been replaced withresolve_conflicts_on_createandresolve_conflicts_on_deletenow thatresolve_conflictsis deprecated - The default/fallback value for the
preserveargument ofcluster_addonsis now set totrue. This has shown to be useful for users deprovisioning clusters while avoiding the situation where the CNI is deleted too early and causes resources to be left orphaned resulting in conflicts. - The Karpenter sub-module's use of the
irsanaming convention has been removed, along with an update to the Karpenter controller IAM policy to align with Karpenter'sv1beta1/v0.32changes. Instead of referring to the role asirsaorpod_identity, its simply just an IAM role used by the Karpenter controller and there is support for use with either IRSA and/or Pod Identity (default) at this time - The
aws-authConfigMap resources have been moved to a standalone sub-module. This removes the Kubernetes provider requirement from the main module and allows for theaws-authConfigMap to be managed independently of the main module. This sub-module will be removed entirely in the next major release. - Support for cluster access management has been added with the default authentication mode set as
API_AND_CONFIG_MAP. This is a one way change if applied; if you wish to useCONFIG_MAP, you will need to setauthentication_mode = "CONFIG_MAP"explicitly when upgrading. - Karpenter EventBridge rule key
spot_interruptupdated to correct mis-spelling (wasspot_interupt). This will cause the rule to be replaced
Additional changes
Added
- A module tag has been added to the cluster control plane
- Support for cluster access entries. The
bootstrap_cluster_creator_admin_permissionssetting on the control plane has been hardcoded tofalsesince this operation is a one time operation only at cluster creation per the EKS API. Instead, users can enable/disableenable_cluster_creator_admin_permissionsat any time to achieve the same functionality. This takes the identity that Terraform is using to make API calls and maps it into a cluster admin via an access entry. For users on existing clusters, you will need to remove the default cluster administrator that was created by EKS prior to the cluster access entry APIs - see the sectionRemoving the default cluster administratorfor more details. - Support for specifying the CloudWatch log group class (standard or infrequent access)
- Native support for Windows based managed nodegroups similar to AL2 and Bottlerocket
- Self-managed nodegroups now support
instance_maintenance_policyand have addedmax_healthy_percentage,scale_in_protected_instances, andstandby_instancesarguments to theinstance_refresh.preferencesblock
Modified
- For
sts:AssumeRolepermissions by services, the use of dynamically looking up the DNS suffix has been replaced with the static value ofamazonaws.com. This does not appear to change by partition and instead requires users to set this manually for non-commercial regions. - The default value for
kms_key_enable_default_policyhas changed fromfalsetotrueto align with the default behavior of theaws_kms_keyresource - The Karpenter default value for
create_instance_profilehas changed fromtruetofalseto align with the changes in Karpenter v0.32 - The Karpenter variable
create_instance_profiledefault value has changed fromtruetofalse. Starting with Karpenterv0.32.0, Karpenter accepts an IAM role and creates the EC2 instance profile used by the nodes
Removed
- The
completeexample has been removed due to its redundancy with the other examples - References to the IRSA sub-module in the IAM repository have been removed. Once https://github.com/clowdhaus/terraform-aws-eks-pod-identity has been updated and moved into the organization, the documentation here will be updated to mention the new module.