From f881745f0062ad6b425500321b7c31465c6afbad Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Mon, 9 Jul 2018 10:40:25 +0200
Subject: [PATCH 1/6] formatting and minor cosmetic fixes

---
 README.md  | 10 +++++-----
 cluster.tf |  2 +-
 data.tf    | 16 ++++++++--------
 outputs.tf | 10 +++++-----
 workers.tf | 16 ++++++++--------
 5 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/README.md b/README.md
index 38fac85..4ca0414 100644
--- a/README.md
+++ b/README.md
@@ -98,18 +98,18 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
-| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
-| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `<list>` | no |
+| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | boolean | `true` | no |
+| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no |
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
 | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
 | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
-| tags | A map of tags to add to all resources. | string | `<map>` | no |
+| tags | A map of tags to add to all resources. | map | `` | no |
 | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
-| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `<list>` | no |
+| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no |
 | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no |
 | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
-| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
+| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no |
 | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no |
 
 ## Outputs
diff --git a/cluster.tf b/cluster.tf
index 87ad721..3abe774 100644
--- a/cluster.tf
+++ b/cluster.tf
@@ -1,4 +1,4 @@
-resource "aws_eks_cluster" "this" {
+resource "aws_eks_cluster" "cluster" {
   name     = "${var.cluster_name}"
   role_arn = "${aws_iam_role.cluster.arn}"
   version  = "${var.cluster_version}"
diff --git a/data.tf b/data.tf
index 9d54f87..1a47420 100644
--- a/data.tf
+++ b/data.tf
@@ -48,11 +48,11 @@ data "template_file" "kubeconfig" {
   template = "${file("${path.module}/templates/kubeconfig.tpl")}"
 
   vars {
-    cluster_name                      = "${var.cluster_name}"
+    cluster_name                      = "${aws_eks_cluster.cluster.name}"
+    endpoint                          = "${aws_eks_cluster.cluster.endpoint}"
     kubeconfig_name                   = "${local.kubeconfig_name}"
-    endpoint                          = "${aws_eks_cluster.this.endpoint}"
     region                            = "${data.aws_region.current.name}"
-    cluster_auth_base64               = "${aws_eks_cluster.this.certificate_authority.0.data}"
+    cluster_auth_base64               = "${aws_eks_cluster.cluster.certificate_authority.0.data}"
     aws_authenticator_command         = "${var.kubeconfig_aws_authenticator_command}"
     aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? "        - ${join("\n        - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }"
     aws_authenticator_env_variables   = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? "      env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}"
@@ -73,7 +73,7 @@ EOF
   }
 }
 
-data template_file config_map_aws_auth {
+data "template_file" "config_map_aws_auth" {
   template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}"
 
   vars {
@@ -81,15 +81,15 @@ data template_file config_map_aws_auth {
   }
 }
 
-data template_file userdata {
+data "template_file" "userdata" {
   template = "${file("${path.module}/templates/userdata.sh.tpl")}"
   count    = "${length(var.worker_groups)}"
 
   vars {
     region              = "${data.aws_region.current.name}"
-    cluster_name        = "${var.cluster_name}"
-    endpoint            = "${aws_eks_cluster.this.endpoint}"
-    cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}"
+    cluster_name        = "${aws_eks_cluster.cluster.name}"
+    endpoint            = "${aws_eks_cluster.cluster.endpoint}"
+    cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}"
     max_pod_count       = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}"
     pre_userdata        = "${lookup(var.worker_groups[count.index], "pre_userdata",lookup(var.workers_group_defaults, "pre_userdata"))}"
     additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}"
diff --git a/outputs.tf b/outputs.tf
index 9f5a16f..f893792 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,27 +1,27 @@
 output "cluster_id" {
   description = "The name/id of the EKS cluster."
-  value       = "${aws_eks_cluster.this.id}"
+  value       = "${aws_eks_cluster.cluster.id}"
 }
 
 # Though documented, not yet supported
 # output "cluster_arn" {
 #   description = "The Amazon Resource Name (ARN) of the cluster."
-#   value       = "${aws_eks_cluster.this.arn}"
+#   value       = "${aws_eks_cluster.cluster.arn}"
 # }
 
 output "cluster_certificate_authority_data" {
   description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster."
-  value       = "${aws_eks_cluster.this.certificate_authority.0.data}"
+  value       = "${aws_eks_cluster.cluster.certificate_authority.0.data}"
 }
 
 output "cluster_endpoint" {
   description = "The endpoint for your EKS Kubernetes API."
-  value       = "${aws_eks_cluster.this.endpoint}"
+  value       = "${aws_eks_cluster.cluster.endpoint}"
 }
 
 output "cluster_version" {
   description = "The Kubernetes server version for the EKS cluster."
-  value       = "${aws_eks_cluster.this.version}"
+  value       = "${aws_eks_cluster.cluster.version}"
 }
 
 output "cluster_security_group_id" {
diff --git a/workers.tf b/workers.tf
index e83412f..18b3dda 100644
--- a/workers.tf
+++ b/workers.tf
@@ -1,5 +1,5 @@
 resource "aws_autoscaling_group" "workers" {
-  name_prefix          = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
+  name_prefix          = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
   desired_capacity     = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}"
   max_size             = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}"
   min_size             = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}"
@@ -9,8 +9,8 @@ resource "aws_autoscaling_group" "workers" {
 
   tags = ["${concat(
     list(
-      map("key", "Name", "value", "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true),
-      map("key", "kubernetes.io/cluster/${var.cluster_name}", "value", "owned", "propagate_at_launch", true),
+      map("key", "Name", "value", "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true),
+      map("key", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "value", "owned", "propagate_at_launch", true),
     ),
     local.asg_tags)
   }"]
@@ -21,7 +21,7 @@ resource "aws_autoscaling_group" "workers" {
 }
 
 resource "aws_launch_configuration" "workers" {
-  name_prefix                 = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
+  name_prefix                 = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
   associate_public_ip_address = "${lookup(var.worker_groups[count.index], "public_ip", lookup(var.workers_group_defaults, "public_ip"))}"
   security_groups             = ["${local.worker_security_group_id}"]
   iam_instance_profile        = "${aws_iam_instance_profile.workers.id}"
@@ -42,11 +42,11 @@ resource "aws_launch_configuration" "workers" {
 }
 
 resource "aws_security_group" "workers" {
-  name_prefix = "${var.cluster_name}"
+  name_prefix = "${aws_eks_cluster.cluster.name}"
   description = "Security group for all nodes in the cluster."
   vpc_id      = "${var.vpc_id}"
   count       = "${var.worker_security_group_id == "" ? 1 : 0}"
-  tags        = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_worker_sg", "kubernetes.io/cluster/${var.cluster_name}", "owned"
+  tags        = "${merge(var.tags, map("Name", "${aws_eks_cluster.cluster.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "owned"
   ))}"
 }
 
@@ -84,12 +84,12 @@ resource "aws_security_group_rule" "workers_ingress_cluster" {
 }
 
 resource "aws_iam_role" "workers" {
-  name_prefix        = "${var.cluster_name}"
+  name_prefix        = "${aws_eks_cluster.cluster.name}"
   assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}"
 }
 
 resource "aws_iam_instance_profile" "workers" {
-  name_prefix = "${var.cluster_name}"
+  name_prefix = "${aws_eks_cluster.cluster.name}"
   role        = "${aws_iam_role.workers.name}"
 }
 

From 1a1d92da6636cdca1c2fea233cc40a8fc902ce4e Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Mon, 9 Jul 2018 10:53:14 +0200
Subject: [PATCH 2/6] Splitting aws-auth and kubectl related resources as they
 are not related

---
 README.md    |  3 ++-
 aws_auth.tf  | 18 ++++++++++++++++++
 kubectl.tf   | 21 +--------------------
 variables.tf |  9 +++++++--
 4 files changed, 28 insertions(+), 23 deletions(-)
 create mode 100644 aws_auth.tf

diff --git a/README.md b/README.md
index 38fac85..3df5bf3 100644
--- a/README.md
+++ b/README.md
@@ -98,7 +98,8 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
-| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
+| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | boolean | `true` | no |
+| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | boolean | `true` | no | 
 | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `<list>` | no |
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
 | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
diff --git a/aws_auth.tf b/aws_auth.tf
new file mode 100644
index 0000000..79e35cc
--- /dev/null
+++ b/aws_auth.tf
@@ -0,0 +1,18 @@
+resource "local_file" "config_map_aws_auth" {
+  content  = "${data.template_file.config_map_aws_auth.rendered}"
+  filename = "${var.config_output_path}/config-map-aws-auth.yaml"
+  count    = "${var.manage_aws_auth ? 1 : 0}"
+}
+
+resource "null_resource" "configure_kubectl" {
+  provisioner "local-exec" {
+    command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
+  }
+
+  triggers {
+    config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
+    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
+  }
+
+  count = "${var.manage_aws_auth ? 1 : 0}"
+}
diff --git a/kubectl.tf b/kubectl.tf
index 4c56a62..ec39963 100644
--- a/kubectl.tf
+++ b/kubectl.tf
@@ -1,24 +1,5 @@
 resource "local_file" "kubeconfig" {
   content  = "${data.template_file.kubeconfig.rendered}"
   filename = "${var.config_output_path}/kubeconfig_${var.cluster_name}"
-  count    = "${var.configure_kubectl_session ? 1 : 0}"
-}
-
-resource "local_file" "config_map_aws_auth" {
-  content  = "${data.template_file.config_map_aws_auth.rendered}"
-  filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml"
-  count    = "${var.configure_kubectl_session ? 1 : 0}"
-}
-
-resource "null_resource" "configure_kubectl" {
-  provisioner "local-exec" {
-    command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}"
-  }
-
-  triggers {
-    config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
-    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
-  }
-
-  count = "${var.configure_kubectl_session ? 1 : 0}"
+  count    = "${var.write_kubeconfig ? 1 : 0}"
 }
diff --git a/variables.tf b/variables.tf
index 1302a48..c6dc071 100644
--- a/variables.tf
+++ b/variables.tf
@@ -22,8 +22,13 @@ variable "config_output_path" {
   default     = "./"
 }
 
-variable "configure_kubectl_session" {
-  description = "Configure the current session's kubectl to use the instantiated EKS cluster."
+variable "write_kubeconfig" {
+  description = "Whether to write a kubeconfig file containing the cluster configuration"
+  default     = true
+}
+
+variable "manage_aws_auth" {
+  description = "Whether to write and apply the aws-auth configmap file"
   default     = true
 }
 

From 11cd282ec19974375d1f84356818b7c7abd18ce3 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Tue, 10 Jul 2018 10:15:08 +0200
Subject: [PATCH 3/6] reverting some changes after feedback

---
 README.md  | 12 ++++++------
 cluster.tf |  2 +-
 data.tf    | 12 ++++++------
 outputs.tf | 10 +++++-----
 workers.tf | 16 ++++++++--------
 5 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index 4ca0414..e9d81c5 100644
--- a/README.md
+++ b/README.md
@@ -98,18 +98,18 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
-| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | boolean | `true` | no |
-| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no |
+| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
+| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `<list>` | no |
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
-| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
+| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `<map>` | no |
 | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
-| tags | A map of tags to add to all resources. | map | `` | no |
+| tags | A map of tags to add to all resources. | map | `<map>` | no |
 | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
-| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no |
+| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `<list>` | no |
 | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no |
 | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
-| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no |
+| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
 | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no |
 
 ## Outputs
diff --git a/cluster.tf b/cluster.tf
index 3abe774..87ad721 100644
--- a/cluster.tf
+++ b/cluster.tf
@@ -1,4 +1,4 @@
-resource "aws_eks_cluster" "cluster" {
+resource "aws_eks_cluster" "this" {
   name     = "${var.cluster_name}"
   role_arn = "${aws_iam_role.cluster.arn}"
   version  = "${var.cluster_version}"
diff --git a/data.tf b/data.tf
index 1a47420..76a7eb6 100644
--- a/data.tf
+++ b/data.tf
@@ -48,11 +48,11 @@ data "template_file" "kubeconfig" {
   template = "${file("${path.module}/templates/kubeconfig.tpl")}"
 
   vars {
-    cluster_name                      = "${aws_eks_cluster.cluster.name}"
-    endpoint                          = "${aws_eks_cluster.cluster.endpoint}"
+    cluster_name                      = "${aws_eks_cluster.this.name}"
     kubeconfig_name                   = "${local.kubeconfig_name}"
+    endpoint                          = "${aws_eks_cluster.this.endpoint}"
     region                            = "${data.aws_region.current.name}"
-    cluster_auth_base64               = "${aws_eks_cluster.cluster.certificate_authority.0.data}"
+    cluster_auth_base64               = "${aws_eks_cluster.this.certificate_authority.0.data}"
     aws_authenticator_command         = "${var.kubeconfig_aws_authenticator_command}"
     aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? "        - ${join("\n        - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }"
     aws_authenticator_env_variables   = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? "      env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}"
@@ -87,9 +87,9 @@ data "template_file" "userdata" {
 
   vars {
     region              = "${data.aws_region.current.name}"
-    cluster_name        = "${aws_eks_cluster.cluster.name}"
-    endpoint            = "${aws_eks_cluster.cluster.endpoint}"
-    cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}"
+    cluster_name        = "${aws_eks_cluster.this.name}"
+    endpoint            = "${aws_eks_cluster.this.endpoint}"
+    cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}"
     max_pod_count       = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}"
     pre_userdata        = "${lookup(var.worker_groups[count.index], "pre_userdata",lookup(var.workers_group_defaults, "pre_userdata"))}"
     additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}"
diff --git a/outputs.tf b/outputs.tf
index f893792..9f5a16f 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,27 +1,27 @@
 output "cluster_id" {
   description = "The name/id of the EKS cluster."
-  value       = "${aws_eks_cluster.cluster.id}"
+  value       = "${aws_eks_cluster.this.id}"
 }
 
 # Though documented, not yet supported
 # output "cluster_arn" {
 #   description = "The Amazon Resource Name (ARN) of the cluster."
-#   value       = "${aws_eks_cluster.cluster.arn}"
+#   value       = "${aws_eks_cluster.this.arn}"
 # }
 
 output "cluster_certificate_authority_data" {
   description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster."
-  value       = "${aws_eks_cluster.cluster.certificate_authority.0.data}"
+  value       = "${aws_eks_cluster.this.certificate_authority.0.data}"
 }
 
 output "cluster_endpoint" {
   description = "The endpoint for your EKS Kubernetes API."
-  value       = "${aws_eks_cluster.cluster.endpoint}"
+  value       = "${aws_eks_cluster.this.endpoint}"
 }
 
 output "cluster_version" {
   description = "The Kubernetes server version for the EKS cluster."
-  value       = "${aws_eks_cluster.cluster.version}"
+  value       = "${aws_eks_cluster.this.version}"
 }
 
 output "cluster_security_group_id" {
diff --git a/workers.tf b/workers.tf
index 18b3dda..ac0b157 100644
--- a/workers.tf
+++ b/workers.tf
@@ -1,5 +1,5 @@
 resource "aws_autoscaling_group" "workers" {
-  name_prefix          = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
+  name_prefix          = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
   desired_capacity     = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}"
   max_size             = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}"
   min_size             = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}"
@@ -9,8 +9,8 @@ resource "aws_autoscaling_group" "workers" {
 
   tags = ["${concat(
     list(
-      map("key", "Name", "value", "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true),
-      map("key", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "value", "owned", "propagate_at_launch", true),
+      map("key", "Name", "value", "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true),
+      map("key", "kubernetes.io/cluster/${aws_eks_cluster.this.name}", "value", "owned", "propagate_at_launch", true),
     ),
     local.asg_tags)
   }"]
@@ -21,7 +21,7 @@ resource "aws_autoscaling_group" "workers" {
 }
 
 resource "aws_launch_configuration" "workers" {
-  name_prefix                 = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
+  name_prefix                 = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
   associate_public_ip_address = "${lookup(var.worker_groups[count.index], "public_ip", lookup(var.workers_group_defaults, "public_ip"))}"
   security_groups             = ["${local.worker_security_group_id}"]
   iam_instance_profile        = "${aws_iam_instance_profile.workers.id}"
@@ -42,11 +42,11 @@ resource "aws_launch_configuration" "workers" {
 }
 
 resource "aws_security_group" "workers" {
-  name_prefix = "${aws_eks_cluster.cluster.name}"
+  name_prefix = "${aws_eks_cluster.this.name}"
   description = "Security group for all nodes in the cluster."
   vpc_id      = "${var.vpc_id}"
   count       = "${var.worker_security_group_id == "" ? 1 : 0}"
-  tags        = "${merge(var.tags, map("Name", "${aws_eks_cluster.cluster.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "owned"
+  tags        = "${merge(var.tags, map("Name", "${aws_eks_cluster.this.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.this.name}", "owned"
   ))}"
 }
 
@@ -84,12 +84,12 @@ resource "aws_security_group_rule" "workers_ingress_cluster" {
 }
 
 resource "aws_iam_role" "workers" {
-  name_prefix        = "${aws_eks_cluster.cluster.name}"
+  name_prefix        = "${aws_eks_cluster.this.name}"
   assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}"
 }
 
 resource "aws_iam_instance_profile" "workers" {
-  name_prefix = "${aws_eks_cluster.cluster.name}"
+  name_prefix = "${aws_eks_cluster.this.name}"
   role        = "${aws_iam_role.workers.name}"
 }
 

From 2a0a595940d17877f3d60b007a4844da638904d4 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Mon, 9 Jul 2018 12:29:11 +0200
Subject: [PATCH 4/6] renaming resource and removing trigger

---
 README.md   | 4 ++--
 aws_auth.tf | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 3df5bf3..62eed49 100644
--- a/README.md
+++ b/README.md
@@ -98,8 +98,8 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
-| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | boolean | `true` | no |
-| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | boolean | `true` | no | 
+| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no |
+| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | string | `true` | no |
 | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `<list>` | no |
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
 | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
diff --git a/aws_auth.tf b/aws_auth.tf
index 79e35cc..6038dc5 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -4,14 +4,13 @@ resource "local_file" "config_map_aws_auth" {
   count    = "${var.manage_aws_auth ? 1 : 0}"
 }
 
-resource "null_resource" "configure_kubectl" {
+resource "null_resource" "update_config_map_aws_auth" {
   provisioner "local-exec" {
     command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
   }
 
   triggers {
     config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
-    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
   }
 
   count = "${var.manage_aws_auth ? 1 : 0}"

From f238e43c014b38acb5144db41c641271b38ab950 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Tue, 10 Jul 2018 12:55:38 +0200
Subject: [PATCH 5/6] adding types to fix the output of terraform-docs command

---
 README.md    | 1 +
 variables.tf | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e9d81c5..fb0b265 100644
--- a/README.md
+++ b/README.md
@@ -126,3 +126,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_iam_role_name | IAM role name attached to EKS workers |
 | worker_security_group_id | Security group ID attached to the EKS workers. |
 | workers_asg_arns | IDs of the autoscaling groups containing workers. |
+
diff --git a/variables.tf b/variables.tf
index 1302a48..63c09b7 100644
--- a/variables.tf
+++ b/variables.tf
@@ -34,6 +34,7 @@ variable "subnets" {
 
 variable "tags" {
   description = "A map of tags to add to all resources."
+  type        = "map"
   default     = {}
 }
 
@@ -87,15 +88,17 @@ variable "kubeconfig_aws_authenticator_command" {
 
 variable "kubeconfig_aws_authenticator_additional_args" {
   description = "Any additional arguments to pass to the authenticator such as the role to assume [\"-r\", \"MyEksRole\"]"
+  type        = "list"
   default     = []
 }
 
 variable "kubeconfig_aws_authenticator_env_variables" {
   description = "Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = \"eks\"}"
+  type        = "map"
   default     = {}
 }
 
 variable "kubeconfig_name" {
-  description = "Override the default name used for items kubeconfig"
+  description = "Override the default name used for items kubeconfig."
   default     = ""
 }

From 4dce83bd9604e7d0d1da014086a7cd84972bdf8f Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Tue, 10 Jul 2018 12:56:54 +0200
Subject: [PATCH 6/6] updates after running terraform-docs

---
 README.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 62eed49..1cd024b 100644
--- a/README.md
+++ b/README.md
@@ -98,12 +98,11 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
-| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no |
-| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | string | `true` | no |
 | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `<list>` | no |
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
 | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
-| kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
+| kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no |
+| manage_aws_auth | Whether to write and apply the aws-auth configmap file | string | `true` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
 | tags | A map of tags to add to all resources. | string | `<map>` | no |
 | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
@@ -112,6 +111,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
 | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
 | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no |
+| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration | string | `true` | no |
 
 ## Outputs
 
@@ -127,3 +127,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_iam_role_name | IAM role name attached to EKS workers |
 | worker_security_group_id | Security group ID attached to the EKS workers. |
 | workers_asg_arns | IDs of the autoscaling groups containing workers. |
+