Terraform创建EKS VPC-CNI插件并关联IAM角色的正确配置

我按Terraform官方文档创建了aws_eks_addon资源，以及VPC-CNI插件对应的IAM角色和策略，所有资源创建无报错，但VPC-CNI插件无法正常工作，核心原因是插件未与IAM角色建立关联。

最初我误以为要通过configuration_values参数配置，但查阅文档后无法确定具体配置项。后来通过AWS控制台手动修改插件配置，再执行terraform plan对比差异，发现正确的配置方式是在aws_eks_addon资源顶层设置service_account_role_arn属性，将其关联到已创建的IAM角色ARN。

修改后的完整代码 #

resource "aws_eks_addon" "addons" {
  for_each                    = { for addon in var.addons : addon.name => addon }
  cluster_name                = data.terraform_remote_state.core.outputs.cluster_id
  addon_name                  = each.value.name
  addon_version               = each.value.version
  resolve_conflicts_on_create = "OVERWRITE"
  resolve_conflicts_on_update = "OVERWRITE"

  # 仅为VPC-CNI插件关联IAM角色
  service_account_role_arn = each.value.name == "vpc-cni" ? aws_iam_role.vpc_cni_role.arn : null
}

variable "addons" {
  type = list(object({
    name    = string
    version = string
  }))

  default = [
    {
       name    = "kube-proxy"
       version = "v1.28.2-eksbuild.2"
    },
    {
       name    = "vpc-cni"
       version = "v1.15.3-eksbuild.1"
    },
    {
       name    = "coredns"
       version = "v1.10.1-eksbuild.5"
    },
    {
       name    = "aws-ebs-csi-driver"
       version = "v1.24.1-eksbuild.1"
    },
    {
       name    = "aws-efs-csi-driver"
       version = "v1.7.0-eksbuild.1"
    }
  ]
}

data "tls_certificate" "cluster_oidc_issuer_url" {
  url = data.terraform_remote_state.core.outputs.cluster_oidc_issuer_url
}

data "aws_iam_policy_document" "openid_connect_provider_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    effect  = "Allow"

    condition {
      test = "StringEquals"
      variable = "${replace(data.terraform_remote_state.core.outputs.aws_iam_openid_connect_provider_extract_from_arn, "https://", "")}:sub"
      values   = ["system:serviceaccount:kube-system:aws-node"]
    }

    principals {
      identifiers = [data.terraform_remote_state.core.outputs.aws_iam_openid_connect_provider_arn]
       type        = "Federated"
    }
  }
}

resource "aws_iam_role" "vpc_cni_role" {
  assume_role_policy = data.aws_iam_policy_document.openid_connect_provider_assume_role_policy.json
  name               = "${var.environment}-vpc-cni-role"
}

resource "aws_iam_role_policy_attachment" "vpc_cni_role_policy_attach" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
 role       = aws_iam_role.vpc_cni_role.name
}

关键修改说明 #

• 在aws_eks_addon资源中新增service_account_role_arn属性，通过条件判断仅为vpc-cni插件关联对应的IAM角色ARN，其他插件无需关联则设为null
• 该属性是aws_eks_addon的顶层配置项，而非嵌套在configuration_values中，这是之前误解的核心点

内容的提问来源于stack exchange，提问作者wkhatch