feat!: Add support for Outposts, remove node security group, add support for addon preserve and most_recent configurations (#2250)

Co-authored-by: Anton Babenko <anton@antonbabenko.com>
Resolves undefined

modules/fargate-profile/README.md

@@ -8,8 +8,8 @@ Configuration in this directory creates a Fargate EKS Profile
 module "fargate_profile" {
   source = "terraform-aws-modules/eks/aws//modules/fargate-profile"
 
-  name                = "separate-fargate-profile"
-  cluster_name        = "my-cluster"
+  name         = "separate-fargate-profile"
+  cluster_name = "my-cluster"
 
   subnet_ids = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"]
   selectors = [{
@@ -28,14 +28,14 @@ module "fargate_profile" {
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.45 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.45 |
 
 ## Modules
 
@@ -47,6 +47,7 @@ No modules.
 |------|------|
 | [aws_eks_fargate_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_fargate_profile) | resource |
 | [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -60,7 +61,7 @@ No modules.
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | `null` | no |
 | <a name="input_create"></a> [create](#input\_create) | Determines whether to create Fargate profile or not | `bool` | `true` | no |
 | <a name="input_create_iam_role"></a> [create\_iam\_role](#input\_create\_iam\_role) | Determines whether an IAM role is created or to use an existing IAM role | `bool` | `true` | no |
-| <a name="input_iam_role_additional_policies"></a> [iam\_role\_additional\_policies](#input\_iam\_role\_additional\_policies) | Additional policies to be added to the IAM role | `list(string)` | `[]` | no |
+| <a name="input_iam_role_additional_policies"></a> [iam\_role\_additional\_policies](#input\_iam\_role\_additional\_policies) | Additional policies to be added to the IAM role | `map(string)` | `{}` | no |
 | <a name="input_iam_role_arn"></a> [iam\_role\_arn](#input\_iam\_role\_arn) | Existing IAM role ARN for the Fargate profile. Required if `create_iam_role` is set to `false` | `string` | `null` | no |
 | <a name="input_iam_role_attach_cni_policy"></a> [iam\_role\_attach\_cni\_policy](#input\_iam\_role\_attach\_cni\_policy) | Whether to attach the `AmazonEKS_CNI_Policy`/`AmazonEKS_CNI_IPv6_Policy` IAM policy to the IAM IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster | `bool` | `true` | no |
 | <a name="input_iam_role_description"></a> [iam\_role\_description](#input\_iam\_role\_description) | Description of the role | `string` | `null` | no |

modules/fargate-profile/main.tf

@@ -1,13 +1,10 @@
 data "aws_partition" "current" {}
-
 data "aws_caller_identity" "current" {}
 
 locals {
-  iam_role_name = coalesce(var.iam_role_name, var.name, "fargate-profile")
-
+  iam_role_name          = coalesce(var.iam_role_name, var.name, "fargate-profile")
   iam_role_policy_prefix = "arn:${data.aws_partition.current.partition}:iam::aws:policy"
-
-  cni_policy = var.cluster_ip_family == "ipv6" ? "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/AmazonEKS_CNI_IPv6_Policy" : "${local.iam_role_policy_prefix}/AmazonEKS_CNI_Policy"
+  cni_policy             = var.cluster_ip_family == "ipv6" ? "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/AmazonEKS_CNI_IPv6_Policy" : "${local.iam_role_policy_prefix}/AmazonEKS_CNI_Policy"
 }
 
 ################################################################################
@@ -44,10 +41,17 @@ resource "aws_iam_role" "this" {
 }
 
 resource "aws_iam_role_policy_attachment" "this" {
-  for_each = var.create && var.create_iam_role ? toset(compact(distinct(concat([
+  for_each = { for k, v in toset(compact([
     "${local.iam_role_policy_prefix}/AmazonEKSFargatePodExecutionRolePolicy",
     var.iam_role_attach_cni_policy ? local.cni_policy : "",
-  ], var.iam_role_additional_policies)))) : toset([])
+  ])) : k => v if var.create && var.create_iam_role }
+
+  policy_arn = each.value
+  role       = aws_iam_role.this[0].name
+}
+
+resource "aws_iam_role_policy_attachment" "additional" {
+  for_each = { for k, v in var.iam_role_additional_policies : k => v if var.create && var.create_iam_role }
 
   policy_arn = each.value
   role       = aws_iam_role.this[0].name

modules/fargate-profile/outputs.tf

@@ -4,7 +4,7 @@
 
 output "iam_role_name" {
   description = "The name of the IAM role"
-  value       = try(aws_iam_role.this[0].name, "")
+  value       = try(aws_iam_role.this[0].name, null)
 }
 
 output "iam_role_arn" {
@@ -14,7 +14,7 @@ output "iam_role_arn" {
 
 output "iam_role_unique_id" {
   description = "Stable and unique string identifying the IAM role"
-  value       = try(aws_iam_role.this[0].unique_id, "")
+  value       = try(aws_iam_role.this[0].unique_id, null)
 }
 
 ################################################################################
@@ -23,20 +23,20 @@ output "iam_role_unique_id" {
 
 output "fargate_profile_arn" {
   description = "Amazon Resource Name (ARN) of the EKS Fargate Profile"
-  value       = try(aws_eks_fargate_profile.this[0].arn, "")
+  value       = try(aws_eks_fargate_profile.this[0].arn, null)
 }
 
 output "fargate_profile_id" {
   description = "EKS Cluster name and EKS Fargate Profile name separated by a colon (`:`)"
-  value       = try(aws_eks_fargate_profile.this[0].id, "")
+  value       = try(aws_eks_fargate_profile.this[0].id, null)
 }
 
 output "fargate_profile_status" {
   description = "Status of the EKS Fargate Profile"
-  value       = try(aws_eks_fargate_profile.this[0].status, "")
+  value       = try(aws_eks_fargate_profile.this[0].status, null)
 }
 
 output "fargate_profile_pod_execution_role_arn" {
   description = "Amazon Resource Name (ARN) of the EKS Fargate Profile Pod execution role ARN"
-  value       = try(aws_eks_fargate_profile.this[0].pod_execution_role_arn, "")
+  value       = try(aws_eks_fargate_profile.this[0].pod_execution_role_arn, null)
 }

modules/fargate-profile/variables.tf

@@ -70,8 +70,8 @@ variable "iam_role_attach_cni_policy" {
 
 variable "iam_role_additional_policies" {
   description = "Additional policies to be added to the IAM role"
-  type        = list(string)
-  default     = []
+  type        = map(string)
+  default     = {}
 }
 
 variable "iam_role_tags" {

modules/fargate-profile/versions.tf

@@ -1,10 +1,10 @@
 terraform {
-  required_version = ">= 0.13.1"
+  required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.72"
+      version = ">= 4.45"
     }
   }
 }