Open blaargh opened 1 year ago
Voting for Prioritization
Volunteering to Work on This Issue
Hey @blaargh π Thank you for taking the time to raise this! I don't see anything that's connecting the IAM role in the sample config to the nodegroup/cluster, though something you mentioned did catch my eye:
It doesn't state this explicitly, the force replace is reported on subnet_ids that come from data objects instead.
Can you supply the part of the configuration where you're defining the data source for data.aws_subnets.sz.ids
, and anything that it's dependent on? I think that's going to be a key detail in determining what's going on here.
Hi @justinretzolk
the project structure is a bit more complex, but basically this:
βββ global.tfvars βββ workspace_eks # workspace folder for all eks stuff β βββ variables.tf # passed through variables from .tfvars land here β βββ eks.tf # eks resources that use objects defined from variables.tf
And then the data definition:
data "aws_subnets" "sz" {
filter {
name = "vpc-id"
values = [var.vpc_id]
}
filter {
name = "tag:type"
values = ["sz"]
}
}
var.vpc_id is coming from variables.tf, the value itself for this is coming from the global.tfvars file
Hey @blaargh π Apologies, I should have been more clear (though the configuration bits do help, so happy accident π). What I was looking for was whether or not the data.aws_subnets.sz
data source shows up in the output as a change when you run terraform plan
, and what that logging looks like.
@blaargh is this still an issue or can we close this out now?
Terraform Core Version
1.3.6
AWS Provider Version
4.42.0
Affected Resource(s)
resource "aws_eks_cluster" resource "aws_eks_node_group" resource "aws_iam_role"
Expected Behavior
When making a change to the trust relationship in the IAM role attached to the cluster/nodegroup manually, Terraform should not force replace both resources.
Terraform should NOT care about the trust relationship in my attached IAM role. It doesn't care about the attached policies either. If you change these things manually, AWS EKS doesn't have problems with it either.
Actual Behavior
When changing the trust relationship in the IAM role attached to the cluster/nodegroup manually, Terraform requires a force replace of both. It doesn't state this explicitly, the force replace is reported on subnet_ids that come from data objects instead.
When reverting the manual change of the trust relationship, everything goes back to normal and Terraform reports that the configuration matches the infrastructure.
Relevant Error/Panic Output Snippet
No response
Terraform Configuration Files
Steps to Reproduce
Create an EKS Cluster as well as the attached IAM role via Terraform Modify the IAM Role trust relationship manually in the AWS UI Run Terraform again
Debug Output
No response
Panic Output
No response
Important Factoids
No response
References
No response
Would you like to implement a fix?
None