feat: Install AWS EKS Add-on #167
Conversation
modules/app_eks/add-ons.tf
Outdated
|
|
||
|
|
||
|
|
||
|
|
| "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", | ||
| "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", | ||
| "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", | ||
| ], var.eks_policy_arns) |
There was a problem hiding this comment.
where does this get used?
There was a problem hiding this comment.
Remember when we did all the work on the IAM policy documents? (https://github.com/wandb/terraform-aws-wandb/pull/101/files). I think we determined we have to pass these here as well or the policies aren't attached to the node or the cluster. I'm not sure which.
But if you're asking about the policy specific to the CNI driver, that gets used for anything involving networking in EKS, so grabbing elastic ips, setting up container networking, etc.
| preserve = false | ||
| resolve_conflicts = "OVERWRITE" | ||
| service_account_role_arn = aws_iam_role.node.arn | ||
| } |
There was a problem hiding this comment.
Does this change have any impact on existing workloads?
There was a problem hiding this comment.
It should not have any impact at all.
| ] | ||
|
|
||
| addon_name = "vpc-cni" | ||
| addon_version = "v1.13.0-eksbuild.1" |
There was a problem hiding this comment.
This version is different than the deleted one, just wanna make sure this is the right one
There was a problem hiding this comment.
Yes. One of the things that can be used to differentiate the self-managed plugin vs. the EKS add-on are the version numbers. This particular version is the next "in line" -- most of our clusters, if not all, are running v.1.12 of the plugin, and I'm gunning for keeping the AWS recommendation of upgrading the CNI one minor version at a time.
This PR includes changes to terraform to install the EKS VPC-CNI add-on. This replaces the "self-managed" vpc-cni plugin that is installed on the control plane when the cluster is created.
The EKS Add-on provides promises as to compatibility that are not provided by the self-managed plugin, and these are critical in terms of streamlining the EKS upgrade process.