The aws-auth submodule for the aws/eks module no longer validates

[zenbones]

In the terraform-aws-modules/eks/aws module version 19.17.2 this worked...

module "eks" {
  manage_aws_auth_configmap = true
  aws_auth_roles = [
    {
      rolearn  = data.aws_iam_role.karpenter_instance.arn
      username = "system:node:{{EC2PrivateDNSName}}"
      groups   = ["system:bootstrappers", "system:nodes"]
    },
  ]
  aws_auth_users = var.eks_additional_users
}

But with version 20.14.0 I get...

 Error: Unsupported argument
│
│   on eks-cluster.tf line 90, in module "eks":
│   90:   manage_aws_auth_configmap = true
│
│ An argument named "manage_aws_auth_configmap" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on eks-cluster.tf line 91, in module "eks":
│   91:   aws_auth_roles = [
│
│ An argument named "aws_auth_roles" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on eks-cluster.tf line 98, in module "eks":
│   98:   aws_auth_users = var.eks_additional_users
│
│ An argument named "aws_auth_users" is not expected here.

But checking the docs for aws-auth, the example seems to show that this should still work.

[bryantbiggs]

that is not true - its no longer in the root module, you need to define a new sub-module definition to use that

[zenbones]

First, thank you for the response. The docs should probably be updated... And not to be too dense, but by submodule definition, I should insert something like...

module "eks" {
  aws_auth = {
    manage_aws_auth_configmap = true
    aws_auth_roles = [
      {
        rolearn  = data.aws_iam_role.karpenter_instance.arn
        username = "system:node:{{EC2PrivateDNSName}}"
        groups   = ["system:bootstrappers", "system:nodes"]
      },
    ]
    aws_auth_users = var.eks_additional_users
  }
}

...because I make my way through these things by documentation as opposed to actually knowing what I'm doing.

[zenbones]

I figured out the module declaration. Thnks.

[mkuzmentsov]

@zenbones what's the proper module declaration? I'm experiencing the same issue.

[photonbit]

Whether something is true or not it is complex topic, but I can say that I found the same issue. I understand that this is a change in the contract of the module, and as such it should be treated gently.

For other humans arriving here, taking the original example that opened the issue:

module "eks" {
  manage_aws_auth_configmap = true
  aws_auth_roles = [
    {
      rolearn  = data.aws_iam_role.karpenter_instance.arn
      username = "system:node:{{EC2PrivateDNSName}}"
      groups   = ["system:bootstrappers", "system:nodes"]
    },
  ]
  aws_auth_users = var.eks_additional_users
}

We need to move all auth related things to a new module definition, like

module "eks" {
   source = "terraform-aws-modules/eks/aws"
   cluster_name = "...."
   # All the rest of cluster configuration that was not moved
}

module "aws_auth" {
  source = "terraform-aws-modules/eks/aws//modules/aws-auth"
  manage_aws_auth_configmap = true
  aws_auth_roles = [
    {
      rolearn  = data.aws_iam_role.karpenter_instance.arn
      username = "system:node:{{EC2PrivateDNSName}}"
      groups   = ["system:bootstrappers", "system:nodes"]
    },
  ]
  aws_auth_users = var.eks_additional_users
}

[photonbit]

But if this problem is coming from an upgrade, you might find the following links helpful to find out what else is failing and for a little bit of context:

• https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/UPGRADE-20.0.md
• https://github.com/clowdhaus/terraform-aws-eks-migrate-v19-to-v20
• [Karpenter] AWS EKS Access Entry for Karpenter role aws-ia/terraform-aws-eks-blueprints-addons#389
• https://github.com/aws-ia/terraform-aws-eks-blueprints/blob/a66db17ae26f0683f61314e8142922e6f3c4f124/patterns/karpenter/main.tf#L160

And also:

• https://aws.amazon.com/blogs/containers/a-deep-dive-into-simplified-amazon-eks-access-management-controls/

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.