configmaps "aws-auth" already exists

[moh-abk]

I have issues

I'm submitting a...

• bug report

What is the current behavior?

When deploying a cluster and using only managed node_groups I believe because they're managed, AWS creates the aws-auth automatically and joins them to the cluster.

This means that terraform throws the error configmaps "aws-auth" already exists. So the kubernetes_config_map should update and not throw an error saying the configmap already exists

If this is a bug, how to reproduce? Please include a code sample if relevant.

Deploy the cluster using managed node_groups.

What's the expected behavior?

aws-auth config map should not already exist. kubernetes_config_map should apply/update-in-place aws-auth

Are you able to fix this problem and submit a PR? Link here if you have already.

N/A

Environment details

• Affected module version: v11.1.0
• OS: Linux
• Terraform version: 0.12.24

[dpiddockcmp]

Which version of the module are you using?

This shouldn't be possible if you have manage_aws_auth = true (the default) since v8.0.0.

What is your full module block that produces the problem?

[moh-abk]

module version: v11.1.0

Curious how manage_aws_auth = true is telling AWS not to automatically create the aws-auth config map?

You can see in the guide here - https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html

In the Self-managed nodes tab - AWS says you should kubectl apply -f aws-auth-cm.yaml
In the Amazon EKS managed node groups tab - there's no mention of it so it's automatically done

[moh-abk]

To reproduce this;

• Create eks cluster with self-managed nodes and manage_aws_auth = false
kubectl --kubeconfig=kubeconfig_* -n kube-system get cm aws-auth -o yaml

Error from server (NotFound): configmaps "aws-auth" not found

• Create eks cluster with no self-managed nodes only managed node_groups and manage_aws_auth = false
kubectl --kubeconfig=kubeconfig_* -n kube-system get cm aws-auth -o yaml

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::<REDACTED>:role/<REDACTED>
      username: system:node:{{EC2PrivateDNSName}}
kind: ConfigMap
metadata:
  creationTimestamp: "2020-04-28T11:32:48Z"
  name: aws-auth
  namespace: kube-system
  resourceVersion: "2115"
  selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
  uid: 567137c9-a5d0-4f6e-b3ae-6876e796f42b

[dpiddockcmp]

Yes, AWS does add to the aws-auth config map when creating managed nodes. However there is dependency management in the module to ensure that the aws-auth configmap is applied by terraform in new clusters before attempting to create the managed node groups.

It happens via the null_data_source in node_groups.tf

[JamesDowning]

Using module version v12.0.0 and worker_groups_launch_template also produces this error when trying to create a new cluster.

[pit]

Same error using module version v11.1.0 + manage_aws_auth = true

Error: configmaps "aws-auth" already exists

  on .terraform/modules/eks/aws_auth.tf line 62, in resource "kubernetes_config_map" "aws_auth":
  62: resource "kubernetes_config_map" "aws_auth" {

[pit]

my fault, missed provider "kubernetes" resource in terraform file (see usage example https://github.com/terraform-aws-modules/terraform-aws-eks#usage-example)

[JamesDowning]

my fault, missed provider "kubernetes" resource in terraform file (see usage example https://github.com/terraform-aws-modules/terraform-aws-eks#usage-example)

Same mistake, apologies I didn't realise the provider block was required.

[darrenfurr]

I'm experiencing the same issue with the latest module: 12.0.0

configmaps "aws-auth" already exists�[0m
2020-05-26T19:15:50.0159220Z 
2020-05-26T19:15:50.0160008Z �[0m  on .terraform/modules/kubernetes/terraform-aws-eks-12.0.0/aws_auth.tf line 62, in resource "kubernetes_config_map" "aws_auth":
2020-05-26T19:15:50.0160619Z   62: resource "kubernetes_config_map" "aws_auth" �[4m{�[0m

provider "kubernetes" {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
  token                  = data.aws_eks_cluster_auth.cluster.token
  load_config_file       = false
  version                = "~> 1.11"
}

I am using the provider already & have manage_aws_auth = true

What am I doing wrong here?

[darrenfurr]

FYI - Just a follow-up on this...I am not using managed nodes & was attempting to add a fargate profile to the same EKS cluster, so that is what was causing my error.

Once I removed the fargate profile & IAM role everything worked with the latest version (12.0.0)

[ibratoev]

Same issue here with using the aws_eks_fargate_profile.

[ibratoev]

Looking at the codebase, if I add a dependency in the aws_eks_fargate_profile to the module output config_map_aws_auth - it should work...

[kushalgangan]

Using v12.0.0 with worker_groups_launch_template and getting below error

Error: configmaps "aws-auth" already exists

[darrenfurr]

@ibratoev - did you just add a depends_on=aws_eks_fargate_profile.this to the module?

Or is there a dependencies variable for the module OR is this a PR?

[thpang]

Having the same issue with v12.1.0

Error: configmaps "aws-auth" already exists

  on .terraform/modules/eks/terraform-aws-eks-12.1.0/aws_auth.tf line 64, in resource "kubernetes_config_map" "aws_auth":
  64: resource "kubernetes_config_map" "aws_auth" {

This is on a new cluster being created.