Dependency between eks-pod-identity-agent and CNI

[vietwow]

Hi,

I have just found the situation that we want to create EKS cluster with managed add-on Pod Identity and VPC-CNI using Pod Identity. My code looks like that :

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.31.6"

  ...
  cluster_addons = {
    eks-pod-identity-agent = {
      most_recent = true
    }

    vpc-cni = {
      before_compute = true
      most_recent    = true
      pod_identity_role_arn = {
        role_arn        = local.aws_vpc_cni_pod_identity_role_arn
        service_account = local.aws_vpc_cni_serviceaccount_name
      }
    }

    ...[other add-ons]...
  }
  ...
}

So the problem is terraform (randomly) create vpc-cni before eks-pod-identity-agent is created, this leads to VPC-CNI add-on crash.

So I'm not sure how we can solve this dependency problem. Hope to get help on this. Thank you so much.

Best Regards,
VietNC

[bryantbiggs]

this is not something that we will be able to explicitly control within the module - we cannot control the specific ordering of addons across an unknown variable of addons

[vietwow]

@bryantbiggs. However, as of now, it feels like a circular dependency when using pod identity with CNI in this module, because:

• Terraform waits for the node groups to become healthy, which only happens when their status is "Ready." This means that the CNI must be set up properly first.
• Node never be ready if it got this issue.

[bryantbiggs]

Why are you waiting on compute if you aren't configuring anything on the CNI?

[vietwow]

it's not me but terraform, let me describe again the issue, the situation is I want to deploy an EKS cluster with managed CNI using Pod Identity (like terraform above I posted). The problem is :

• terraform CLI creates managed CNI add-on before eks-pod-identity-agent addon (Note: this is randomly) => so CNI crashed (because it requires eks-pod-identity-agent first)
• terraform module "terraform-aws-eks" create nodegroups parallels with CNIs, and terraform CLI (not me) waits for the node groups to become healthy (which only happens when their status is "Ready"), and because CNI was crashed so nodegroups never become healththy

Not sure if there is something wrong from my understand. Thanks