fix(eks): silence perpetual serviceAccountRoleArn diff on CSI-driver addons#341
Draft
stevenolen wants to merge 1 commit into
Draft
fix(eks): silence perpetual serviceAccountRoleArn diff on CSI-driver addons#341stevenolen wants to merge 1 commit into
stevenolen wants to merge 1 commit into
Conversation
The AWS provider sets aws_eks_addon.service_account_role_arn on create/update but does not reliably read it back into state (terraform-provider-aws#19402), so Pulumi re-proposes the field on every dry-run and each apply triggers an addon reconcile. For the EBS CSI addon that reconcile re-asserts the default StorageClass, the regression addressed separately via configurationValues IgnoreChanges. Add serviceAccountRoleArn to IgnoreChanges on both the EBS and EFS CSI addons. The role ARN is deterministic and set-once, so ignoring it masks nothing real, and IgnoreChanges does not affect creates, so greenfield EKS clusters still receive the role.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add
serviceAccountRoleArntoIgnoreChangeson the EBS and EFS CSI managed-addon resources in the EKS cluster builder.Why
The AWS provider writes
service_account_role_arnon create/update but does not reliably read it back into state (terraform-provider-aws#19402). As a result Pulumi re-proposes+ serviceAccountRoleArnon every dry-run for EKS workloads, and each apply forces an addon reconcile. For the EBS CSI addon that reconcile is the same one that re-asserts the default StorageClass (previously mitigated by ignoringconfigurationValues).Ignoring the field is safe: the role ARN is deterministic and set-once, so there is no real drift being hidden, and
IgnoreChangesdoes not affect resource creation, so new clusters still get the role. This is deliberately the opposite of version fields, which must never be ignored.Testing
just cli— build succeedsjust check-go— cleanjust test-lib— all packages pass