使用Terraform EKS模块创建多集群时aws-auth ConfigMap已存在报错如何解决

你遇到的报错本质是多EKS模块实例共用了同一个Kubernetes Provider上下文，所有集群的aws-auth ConfigMap资源默认写入到同一个Kubernetes集群，自然会触发重名冲突。

• 第一步：为每个EKS集群单独声明带别名的Kubernetes Provider，绑定对应集群的接入凭证
  示例配置如下：

# 开发集群Kubernetes Provider
provider "kubernetes" {
  alias  = "dev"
  host   = module.eks_dev.cluster_endpoint
  cluster_ca_certificate = base64decode(module.eks_dev.cluster_certificate_authority_data)

  exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    command     = "aws"
    args = ["eks", "get-token", "--cluster-name", module.eks_dev.cluster_name, "--region", "us-east-1"] # 替换为对应集群的区域
  }
}

# 测试集群Kubernetes Provider
provider "kubernetes" {
  alias  = "staging"
  host   = module.eks_staging.cluster_endpoint
  cluster_ca_certificate = base64decode(module.eks_staging.cluster_certificate_authority_data)

  exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    command     = "aws"
    args = ["eks", "get-token", "--cluster-name", module.eks_staging.cluster_name, "--region", "us-east-1"]
  }
}

# 生产集群Kubernetes Provider
provider "kubernetes" {
  alias  = "prod"
  host   = module.eks_prod.cluster_endpoint
  cluster_ca_certificate = base64decode(module.eks_prod.cluster_certificate_authority_data)

  exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    command     = "aws"
    args = ["eks", "get-token", "--cluster-name", module.eks_prod.cluster_name, "--region", "us-east-1"]
  }
}

• 第二步：每个EKS模块实例指定对应别名的Kubernetes Provider，开启aws-auth ConfigMap托管开关
  示例配置如下：

module "eks_dev" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 19.0" # 替换为你实际使用的模块版本

  cluster_name = "dev-eks"
  # 其余集群基础配置省略

  manage_aws_auth_configmap = true
  map_roles = [
    # 你原有map_roles配置内容
    {
      rolearn   = "arn:aws:iam::${var.account_no}:role/argo-${var.environment}-${var.aws_region}"
      username  = "system:node:{{EC2PrivateDNSName}}"
      groups    = ["system:bootstrappers","system:nodes"]
    },
    {
      rolearn   = "arn:aws:sts::${var.account_no}:assumed-role/${var.assumed_role_1}"
      username  = "admin"
      groups    = ["system:masters","system:nodes","system:bootstrappers"]
    },
    {
      rolearn  = "arn:aws:sts::${var.account_no}:assumed-role/${var.assumed_role_2}"
      username  = "admin"
      groups    = ["system:masters","system:nodes","system:bootstrappers"]
    }
  ]

  # 关联对应集群的Kubernetes Provider
  providers = {
    kubernetes = kubernetes.dev
  }
}

# 测试、生产集群的EKS模块按相同逻辑配置，分别关联staging、prod别名的Provider即可

• 第三步：清理错误生成的存量资源

1. 执行terraform state list | grep kubernetes_config_map.aws_auth找到状态中错误存储的ConfigMap资源条目，用terraform state rm <资源地址>移除无效条目
2. 手动清理被错误写入ConfigMap的集群中的多余aws-auth资源，操作前务必备份原有ConfigMap内容避免集群节点认证异常

• 不要声明全局无别名的Kubernetes Provider，避免默认上下文被错误复用
• 如果你使用的是v18及更早版本的EKS模块，provider关联逻辑一致，仅部分输出参数名可能存在差异，按需调整即可
• 确保不同集群实例的环境、区域变量不重复，避免生成的IAM角色ARN冲突

内容的提问来源于stack exchange，提问作者Red Bottle