Allow modification of cluster subnets and security groups

[luciano-buono]

Is your request related to a new offering from AWS?

Is this functionality available in the AWS provider for Terraform? See CHANGELOG.md, too.

• Yes ✅: https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#5250-november-10-2023. resource/aws_eks_cluster: Allow vpc_config.security_group_ids and vpc_config.subnet_ids to be updated in-place

Starting in November 2023, AWS allows to change the initial subnets and SGs in a already created EKS cluster:

• https://aws.amazon.com/about-aws/whats-new/2023/10/amazon-eks-modification-cluster-subnets-security/
• https://aws.amazon.com/blogs/containers/enhanced-vpc-flexibility-modify-subnets-and-security-groups-in-amazon-eks/

Is your request related to a problem? Please describe.

Until now it wasn't possible to add a new subnet to the cluster. This was a problem for clusters where you run out of available IPs addresses in a subnet.

Describe the solution you'd like.

Right now adding a new subnet trigger a cluster recreation where it should trigger a cluster modification.

Describe alternatives you've considered.

Additional context

[bryantbiggs]

technically you can do this today by using the latest AWS provider FYI

[PeteMac88]

@luciano-buono Did you test it? And which version of the terraform-aws-eks module did you use?

[luciano-buono]

Hi @PeteMac88, I just tested it. I used AWS 5.25 provider and EKS module v19.20.

I think that using latest module version is not neccesary, the important part is the AWS version as using an older one will result in cluster recreation.

Update is fast, 4m approx. Just make sure the desired subnet is 'elegible'. I just went into the EKS UI to simulate a manual subnet updateand checked that my subnet was listed there

[luciano-buono]

Closing as feature is already implemented

[PeteMac88]

@luciano-buono Thanks for the response! I am currently testing it with AWS provider 5.32.1. Based on the terraform plan currently the cluster is updated but the self-managed node groups are destroyed and recreated. Did you observe a similiar behaviour?

Update: Sorry the resources which are planed to be destroyed and recreated are "node_groups" of capacity type "SPOT"

[bryantbiggs]

if the subnets that are passed to the nodegroup(s) (either self-managed or EKS managed) are changed, that will cause the group to be replaced no matter what

[PeteMac88]

@bryantbiggs Ok but in my terraform plan the module.eks.aws_autoscaling_group.workers_launch_template resource is updated but the module.eks.module.node_groups.aws_eks_node_group.workers are detroyed/recreated. I am currently using version 17.* of the eks module. Could this be the cause?

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.