Not upgrade aws-node vpc cni when upgrading the cluster

[gabrielanavarrorsid]

I'm using the terraform-aws-service-catalog eks-cluster module and noticed there's no way to let the module know that I do not wish to upgrade the vpc cni. The reason I dont need this upgrade is because we use a different CNI and we would like to know how we can configure it to not re-deploy the aws-node vpc CNI.

I checked the terraform-aws-eks repository and noticed that this variable upgrade_cluster_script_skip_vpc_cni exists there but that one is not exposed as a variable on the terraform-aws-service-catalog one. Could this be a feature request to be able to configure this? Or did I miss a configuration that I can use with terraform-aws-service-catalog to achieve this.

---

Tracked in ticket #110905

[josh-padnick]

@ryehowell Could you assist with this one?

[ryehowell]

Hi @gabrielanavarrorsid, apologies on this question being open so long! If you would like to skip the management of the vpc-cni, you can set use_vpc_cni_customize_script to false in the terraform-aws-service-catalog for the eks-cluster module. When this variable is set to false the underlying terraform-aws-eks/eks-cluster-control-plane module will ignore all of the vpc_cni_* variables, skipping the resource that performs the updates to the vpc-cni.

terraform-aws-service-catalog VAR: use_vpc_cni_customize_script

terraform-aws-eks VAR: use_vpc_cni_customize_script

[gabrielanavarrorsid]

heya @ryehowell - no worries!
I tried using that variable but unfortunately it didnt work :/
mainly this resource on the terraform-aws-eks seems to be the problem:

resource "null_resource" "sync_core_components" {
  count = var.use_upgrade_cluster_script && !var.enable_eks_addons ? 1 : 0

  triggers = {
    # The endpoint is what changes when the cluster is redeployed
    eks_cluster_endpoint = aws_eks_cluster.eks.endpoint

    k8s_version = aws_eks_cluster.eks.version

    # We add an artificial dependency to the eks_cluster verification null_resource
    wait_for_api_action_id = null_resource.wait_for_api.id
  }

  provisioner "local-exec" {
    command = "${local.kubergrunt_path} eks sync-core-components --eks-cluster-arn ${aws_eks_cluster.eks.arn} ${var.upgrade_cluster_script_wait_for_rollout ? "--wait" : ""} ${var.upgrade_cluster_script_skip_coredns ? "--skip-coredns" : ""} ${var.upgrade_cluster_script_skip_kube_proxy ? "--skip-kube-proxy" : ""} ${var.upgrade_cluster_script_skip_vpc_cni ? "--skip-aws-vpc-cni" : ""}"
  }
}

The thing is that i just dont want to upgrade the vpc_cni(mainly because we use a different one) but would like to keep upgrading coredns and kube-proxy. i was thinking that adding this upgrade_cluster_script_skip_vpc_cni to terraform-aws-service-catalog would resolve the problem, but unsure if thats the best approach.

[gabrielanavarrorsid]

also one extra note, i checked the issue you opened (Thank you!!) and i think we should expose the upgrade_cluster_script_skip_vpc_cni variable rather than the use_upgrade_cluster_script. maybe we should even do the following ones to have it as flexible as possible:

• upgrade_cluster_script_skip_coredns
• upgrade_cluster_script_skip_kube_proxy
• upgrade_cluster_script_skip_vpc_cni

[ryehowell]

Hi @gabrielanavarrorsid, we'll go ahead and get the additional vars exposed on the terraform-aws-service-catalog. One thing to consider, is moving to manage the other AddOns via the eks_addons mechanism. We plan to move toward this recommendation in the very near future as this is the recommendation from AWS now. We have backlog items for moving to this as the internal implementation and moving away from the existing implementation just as an FYI. I'll follow up once a PR is up for the additional variables being exposed!

[ryehowell]

Hi @gabrielanavarrorsid , just wanted to follow up with the link to the PR. Here is the PR that should expose everything needed to toggle the core components sync functionality. This should get reviewed, merged, and released sometime in the next couple of days - should be early next week (since today is Friday 😄 )

[ryehowell]

Hi @gabrielanavarrorsid , here is the latest release that has the additional vars exposed! Apologies on it taking a little longer than expected to get released. Please give it a try and let me know if it unblocks you.
Release v0.112.10

[ryehowell]

Hi @gabrielanavarrorsid, were you able to validate the latest changes to verify that this has solved the issue you were facing?

[gabrielanavarrorsid]

hey @ryehowell - sorry about the delay here. i'll check the new release next week and let you know :D thanks for the PR and letting me know about it :)

[ryehowell]

Hi @gabrielanavarrorsid, I'd like to close the loop on this. Were you able to validate that the changes addressed this issue?

[gabrielanavarrorsid]

sorry the delay here @ryehowell
i can confirm the new configuration safely allowed me to upgrade the cluster without causing issues with the VPC CNI
thank you so much for the help here.

[vmkk24]

Hey @ryehowell

We're also facing similar kind of issue. Any update regarding this? Below are the logs:

kubergrunt version = 0.12.0 (tried with 0.11.2 & 0.13.0 as well)

[ecs-deploy-runner][2024-05-09T20:35:09+0000] module.eks_cluster.null_resource.sync_core_components[0] (local-exec): ERROR: 1.26 is not a supported version for kubergrunt eks upgrade. Please contact [email protected] for more info.
[ecs-deploy-runner][2024-05-09T20:35:09+0000] ╷
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ Warning: Redundant ignore_changes element
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ on .terraform/modules/eks_cluster/modules/eks-cluster-control-plane/main.tf line 579, in resource "aws_eks_addon" "eks_addon":
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ 579: resource "aws_eks_addon" "eks_addon" {
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ Adding an attribute name to ignore_changes tells Terraform to ignore future
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ changes to the argument in configuration after the object has been created,
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ retaining the value originally configured.
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ The attribute modified_at is decided by the provider alone and therefore
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ there can be no configured value to compare with. Including this attribute
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ in ignore_changes has no effect. Remove the attribute from ignore_changes
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ to quiet this warning.
[ecs-deploy-runner][2024-05-09T20:35:09+0000] ╵
[ecs-deploy-runner][2024-05-09T20:35:09+0000] ╷
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ Error: local-exec provisioner error
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ with module.eks_cluster.null_resource.sync_core_components[0],
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ on .terraform/modules/eks_cluster/modules/eks-cluster-control-plane/main.tf line 152, in resource "null_resource" "sync_core_components":
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ 152: provisioner "local-exec" {
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ Error running command '/usr/local/bin/kubergrunt eks sync-core-components
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ --eks-cluster-arn
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ arn:aws:eks:us-east-1:xxxxxxxxxxx:cluster/xxxxxxxxxxx --wait ':
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ exit status 1. Output: [] time="2024-05-09T20:35:09Z" level=info
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ msg="Looking up deployed Kubernetes version" name=kubergrunt
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ [] time="2024-05-09T20:35:09Z" level=info msg="Retrieving details for EKS
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ cluster arn:aws:eks:us-east-1:xxxxxxxxxxx:cluster/xxxxxxxxxxx"
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ name=kubergrunt
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ [] time="2024-05-09T20:35:09Z" level=info msg="Detected cluster deployed in
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ region us-east-1" name=kubergrunt
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ [] time="2024-05-09T20:35:09Z" level=info msg="Successfully retrieved EKS
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ cluster details" name=kubergrunt
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ ERROR: 1.26 is not a supported version for kubergrunt eks upgrade. Please
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │ contact [email protected] for more info.
[ecs-deploy-runner][2024-05-09T20:35:09+0000] │

[ryehowell]

Hi @vmkk2, the issue you are facing is a separate issue. Would you mind opening an issue in the respective repo where the deploy-runner is being created from (it is instantiated from a few different places, so the location it is being deployed from such as the terraform-aws-service-catalog)