terraform AWS EKS 'destroy' failed module.eks.kubernetes_config_map.aws_auth[0] Error: Unauthorized

[alex-beyond-minds]

Description

at terraform destroy execution it's failing on module.eks.kubernetes_config_map.aws_auth[0]
with error:
Error: Unauthorized

Versions

• Terraform: 1.0.9

• Provider(s): kubernetes 2.6.1

• Module: EKS 17.22.0

Reproduction

Steps to reproduce the behavior:
Are you using workspaces?: yes
Have you cleared the local cache (see Notice section above)?: yes
List steps in order that led up to the issue you encountered:
create AWS EKS cluster with custom users, run terraform destroy.

Code Snippet to Reproduce

module "eks" {
version = "17.22.0"
source = "terraform-aws-modules/eks/aws"
cluster_name = var.cluster_name
cluster_version = "1.21"
.
.
.
map_roles = var.map_roles
map_users = var.map_users
}

Expected behavior

Destroy removes EKS cluster

Actual behavior

Destroy is failing on deleting aws_auth configmap

[vasilinamatov]

I have the same issue with same module version and same cluster version.

[daroga0002]

Unuthorized means you have something wrong with your kubernetes provider as terraform is not able to rach EKS api

[alex-beyond-minds]

Correct, but this is out of my control as all what I have done is added users throug map_users param. and seems by the time aws_auth to be removed, cluster is gone.

[alex-beyond-minds]

I think similar issue has been discovered, but not fixed in the latest release #1162

[daroga0002]

maybe this is related to #1658, please try pin kubernetes provider to lower version

[alex-beyond-minds]

Well, creating is working fine for me. And yes, I tried several versions of kubernetes provider, it didn't help. But thank you for advice.

[alex-beyond-minds]

@daroga0002 just in case re-verified with 2.5.1 version with exact same result.

[daroga0002]

dows from host you are able to curl a api endpoint?

[alex-beyond-minds]

this is actually terraform cloud, and yes it can at normal circumstance. At destroy time, cluster seems get removed first, so aws_auth is left behind untill it's too late and cluster is gone. Seems aws_auth is not something we can control from tf files point of view - this is eks module internals.

[alex-beyond-minds]

@daroga0002 and this is easy to reproduce - create aws EKS cluster through terraform(with additional users and or roles) and try to remove it

[daroga0002]

I am doing this constantly and no issue observed. Only thing which I have now in my mind is that you maybe corrupting a aws_auth configmap by wrong syntax or etc.

[alex-beyond-minds]

@daroga0002 have you tried to add users through the terraform at your testing?

[daroga0002]

yup, running this on prod. Also our example examples/managed_node_groups/main.tf is adding some user entries into aws auth and no issue observed during creation or destroy

[alex-beyond-minds]

Hm. In my case it happens every time I destroy env. What versions are you running it at? (also I manage to use kubectl with my AWS account, so assuming configmap is fine)

[daroga0002]

What versions are you running it at?

I didnt had issue with that, newest version is working fine for me (but also multiple earlier)