From 9c1eb3dc83bcc3a67673f8b4508b9fcd25dcdc09 Mon Sep 17 00:00:00 2001 From: Larry Liu Date: Fri, 22 May 2026 17:28:27 -0700 Subject: [PATCH] Enable EKS API auth mode by default Adds an access_config block to aws_eks_cluster setting authentication_mode = API_AND_CONFIG_MAP by default, controllable via the new cluster_authentication_mode variable. This unblocks teammates with AWS IAM permissions (e.g. for the observability stack) from being locked out of clusters whose aws-auth ConfigMap is only writable by the original creator. API_AND_CONFIG_MAP keeps backward compatibility: existing aws-auth mappings continue to work, and new access can be granted via AWS Access Entries (eks:CreateAccessEntry / associate-access-policy). On existing clusters, terraform apply performs an in-place update with no node disruption. Note that EKS auth mode transitions are one-way: CONFIG_MAP -> API_AND_CONFIG_MAP -> API. Co-Authored-By: Claude Opus 4.7 (1M context) --- terraform-modules/movement-validator-infra/eks.tf | 5 +++++ .../movement-validator-infra/variables.tf | 11 +++++++++++ 2 files changed, 16 insertions(+) diff --git a/terraform-modules/movement-validator-infra/eks.tf b/terraform-modules/movement-validator-infra/eks.tf index f678e1b..740771c 100644 --- a/terraform-modules/movement-validator-infra/eks.tf +++ b/terraform-modules/movement-validator-infra/eks.tf @@ -40,6 +40,11 @@ resource "aws_eks_cluster" "main" { role_arn = aws_iam_role.cluster.arn version = var.kubernetes_version + access_config { + authentication_mode = var.cluster_authentication_mode + bootstrap_cluster_creator_admin_permissions = true + } + vpc_config { subnet_ids = local.control_plane_subnet_ids endpoint_private_access = true diff --git a/terraform-modules/movement-validator-infra/variables.tf b/terraform-modules/movement-validator-infra/variables.tf index e3fc17f..6159228 100644 --- a/terraform-modules/movement-validator-infra/variables.tf +++ b/terraform-modules/movement-validator-infra/variables.tf @@ -14,6 +14,17 @@ variable "kubernetes_version" { default = "1.35" } +variable "cluster_authentication_mode" { + description = "EKS cluster authentication mode. One of CONFIG_MAP (legacy, aws-auth ConfigMap only), API_AND_CONFIG_MAP (recommended; supports both AWS Access Entries and aws-auth), or API (Access Entries only). Switching is one-way: CONFIG_MAP → API_AND_CONFIG_MAP → API." + type = string + default = "API_AND_CONFIG_MAP" + + validation { + condition = contains(["CONFIG_MAP", "API_AND_CONFIG_MAP", "API"], var.cluster_authentication_mode) + error_message = "cluster_authentication_mode must be one of CONFIG_MAP, API_AND_CONFIG_MAP, or API." + } +} + variable "private_subnet_ids" { description = "Private subnet IDs for node group" type = list(string)