fix: Update examples to show integration and usage of new IRSA submodule (#1882)

examples/eks_managed_node_group/main.tf

@@ -29,8 +29,7 @@ module "eks" {
   cluster_endpoint_public_access  = true
 
   # IPV6
-  cluster_ip_family          = "ipv6"
-  create_cni_ipv6_iam_policy = true
+  cluster_ip_family = "ipv6"
 
   cluster_addons = {
     coredns = {
@@ -38,7 +37,8 @@ module "eks" {
     }
     kube-proxy = {}
     vpc-cni = {
-      resolve_conflicts = "OVERWRITE"
+      resolve_conflicts        = "OVERWRITE"
+      service_account_role_arn = module.vpc_cni_irsa.iam_role_arn
     }
   }
 
@@ -87,6 +87,9 @@ module "eks" {
     ami_type       = "AL2_x86_64"
     disk_size      = 50
     instance_types = ["m6i.large", "m5.large", "m5n.large", "m5zn.large"]
+
+    # We are using the IRSA created below for permissions
+    iam_role_attach_cni_policy = false
   }
 
   eks_managed_node_groups = {
@@ -421,6 +424,24 @@ module "vpc" {
   tags = local.tags
 }
 
+module "vpc_cni_irsa" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "~> 4.12"
+
+  role_name_prefix      = "VPC-CNI-IRSA"
+  attach_vpc_cni_policy = true
+  vpc_cni_enable_ipv6   = true
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["kube-system:aws-node"]
+    }
+  }
+
+  tags = local.tags
+}
+
 resource "aws_security_group" "additional" {
   name_prefix = "${local.name}-additional"
   vpc_id      = module.vpc.vpc_id