The module should support eks add-ons deploy flag about terraform-aws-eks HOT 6 CLOSED

If you wish to NOT deploy the addon, simply do not add it into the list of addons 😅

from terraform-aws-eks.

@bryantbiggs I don't think it as trivial as it seems to be, currently there is no way to control add-on deployment conditionally, in my case, that's whether the region is AWS China Region or not.

The current module requires developers to modify the TF code if it has to be deployed in AWS China Region.

from terraform-aws-eks.

Let me guess, you are using Terraform workspaces

from terraform-aws-eks.

Not exactly 👀 , let me explain the issue that I am facing and why I think this feature would be useful.

In my case, I have a TF project deploying EKS using this module, it is looking something like:

locals {
  region = var.region
}

provider "aws" {
  region = local.region
}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.10.0"
 ....
  cluster_addons = {
    aws-efs-csi-driver ={
      most_recent = true
      service_account_role_arn = aws_iam_role.efs_role.arn
    }
  }
}

The above work fine in AWS Global Region (and Gov-Cloud I assume), but in the case of AWS China Region, again, this region doesn't do managed add-on for efs driver. If I am going to deploy it in China region, it would fail as the add-on is not supported.

To handle this, one way to go is to first determine what region are we deploying, if it is AWS China (cn-north-1 and cn-northwest-1), we do not deploy this add-on.

However, since we can't set condition specific for the cluster_addons value, I will need to change the module itselves in order to fulfil this need.

My workaround for this is become

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.10.0"
 ....
}

resource "aws_eks_addon" "efs-driver" {
  count                       =  var.region == "cn-north-1"  || var.region == "cn-northwest-1" ? 0 : 1
  cluster_name                = module.eks.cluster_name
  addon_name                  = "aws-efs-csi-driver"
  service_account_role_arn    = aws_iam_role.efs_role.arn 
}

I hope it help explain the situation :D

from terraform-aws-eks.

I don't follow - why is the region a variable if you aren't using workspaces?

In short - Terraform is declarative. What you see is what you get. If you want something deployed, you define that in your configuration. If you do not want it deployed, you do not define it in your configuration.

from terraform-aws-eks.

Not exactly, the region is being a variable because the TF project allow developers to choose which region. I think it is a common usecase for Terraform, especially for a Terraform Module.

Altogether, I don't think this option violates the best practice of using Terraform, which provide allow resource with condition, i.e. input, like the use of 'count', 'for_each', and 'dynamic'.

Anyway, I think this feature is a good-to-have, as I have a workaround for this :)

from terraform-aws-eks.