Example of using output config_map_aws_auth?

[darrenfurr]

I'm looking for an example of using the output config_map_aws_auth.
I want to apply the configmap when the cluster is first created.

Later, I then add aws_eks_fargate_profile in another Terraform (which also adds to the aws-auth configmap), so if this module is re-run it breaks the Fargate profile.

I tried this:

resource "local_file" "aws_auth" {
  content              = module.kubernetes.config_map_aws_auth
  filename             = "config-map-aws-auth_${module.kubernetes.cluster_id}.yaml"
  file_permission      = "0644"
  directory_permission = "0755"
}

But gives me this error...

module.kubernetes.config_map_aws_auth is empty tuple
This value does not have any attributes.

[dpiddockcmp]

To stop the module from overwriting the Fargate permissions you must pass them in to the module via the map_roles variable.

I don't have a Fargate enabled cluster to had right now so, looking at #866 it would be something like:

map_roles = [
  rolearn  = "arn:....:role/EKSFargatePodRole"
  username = "system:node:{{SessionName}}"
  groups   = ["system:bootstrappers", "system:nodes", "system:node-proxier"]
]

Looking at the source for config_map_aws_auth output it just directly returns the state of the kubernetes_config_map. If you have manage_aws_auth = false set on the module then the output will be an empty tuple.

If manage_aws_auth is true then the output would be slightly more useful but the module will already be trying to create the ConfigMap. You can retrieve its contents with module.eks.config_map_aws_auth[0].data

Looking at this now, I don't see the value of this output as it currently stands, apart from manually comparing to the running state at a later time 🤔

[darrenfurr]

@dpiddockcmp - I would ideally like to have manage_aws_auth = true + the map_roles set for the fargateRole. Will that combine the workerRole + clusterRole + fargateRole into the applied aws-auth configmap? Trying that now...

[darrenfurr]

@dpiddockcmp - I would ideally like to have manage_aws_auth = true + the map_roles set for the fargateRole. Will that combine the workerRole + clusterRole + fargateRole into the applied aws-auth configmap? Trying that now...

@dpiddockcmp - that worked! Thanks so much for this.

[dpiddockcmp]

That's good news 😄

Looking at this now, I don't see the value of this output as it currently stands, apart from manually comparing to the running state at a later time 🤔

To be a dependency target. Can be used to ensure the config map is applied before doing something else that might create the map. 🤦

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.