Refactor for clarity

[Nuru]

breaking changes

Previously, setting enable_cluster_autoscaler = true turned on tagging sufficient for the Kubernetes Cluster Autoscaler to discover and manage the node group, and also added a policy to the node group worker role that allowed the workers to perform the autoscaling function. Since pods by default use the EC2 instance role, which in EKS node groups is the node group worker role, this allowed the Kubernetes Cluster Autoscaler to work from any node, but also allowed any rogue pod to perform autoscaling actions.

With this release, enable_cluster_autoscaler is deprecated and its functions are replaced with 2 new variables:

• cluster_autoscaler_enabled, when true, causes this module to perform the labeling and tagging needed for the Kubernetes Cluster Autoscaler to discover and manage the node group
• worker_role_autoscale_iam_enabled, when true, causes this module to add the IAM policy to the worker IAM role to enable the workers (and by default, any pods running on the workers) to perform autoscaling operations

Going forward, we recommend not using enable_cluster_autoscaler (it will eventually be removed) and leaving worker_role_autoscale_iam_enabled at its default value of false. If you want to use the Kubernetes Cluster Autoscaler, set cluster_autoscaler_enabled = true and use EKS IAM roles for service accounts to give the Cluster Autoscaler service account IAM permissions to perform autoscaling operations. Our Terraform module terraform-aws-eks-iam-role is available to help with this.

what

• Refactor, separating out launch template and IAM parts
• Rename some things for clarity and consistency
• Refine random_pet keepers
• Disable by default the permission for workers to perform autoscaling operations

why

• main.tf was too complex
• Cloud Posse standard is for feature selection booleans to be named with _enabled at the end
• Change in any keepers will cause the node group to be replaced
• Workers should not be performing autoscaling operations, those should be done only by a specific service account

references

• This module appears to be affected by Terraform issue 26166 and should be considered pre-release, not ready for production, until that is resolved. It appears on track to be fixed in Terraform 0.13.3.

[Nuru]

/test all