<p>I've been trying to deploy a self managed node EKS cluster for a while now, with no success. The error I'm stuck on now are EKS addons:</p>
<p><strong>Error: error creating EKS Add-On (DevOpsLabs2b-dev-test--eks:kube-proxy): InvalidParameterException: Addon version specified is not supported, AddonName: &quot;kube-proxy&quot;, ClusterName: &quot;DevOpsLabs2b-dev-test--eks&quot;, Message_: &quot;Addon version specified is not supported&quot; }
with module.eks-ssp-kubernetes-addons.module.aws_kube_proxy[0].aws_eks_addon.kube_proxy
on .terraform/modules/eks-ssp-kubernetes-addons/modules/kubernetes-addons/aws-kube-proxy/main.tf line 19, in resource &quot;aws_eks_addon&quot; &quot;kube_proxy&quot;:</strong></p>
<p>This error repeats for coredns as well, but ebs_csi_driver throws:</p>
<p><strong>Error: unexpected EKS Add-On (DevOpsLabs2b-dev-test--eks:aws-ebs-csi-driver) state returned during creation: timeout while waiting for state to become 'ACTIVE' (last state: 'DEGRADED', timeout: 20m0s) [WARNING] Running terraform apply again will remove the kubernetes add-on and attempt to create it again effectively purging previous add-on configuration</strong></p>
<p>My main.tf looks like this:</p>
<pre><code>terraform {

  backend &quot;remote&quot; {}

  required_providers {
    aws = {
      source  = &quot;hashicorp/aws&quot;
      version = &quot;&gt;= 3.66.0&quot;
    }
    kubernetes = {
      source  = &quot;hashicorp/kubernetes&quot;
      version = &quot;&gt;= 2.7.1&quot;
    }
    helm = {
      source  = &quot;hashicorp/helm&quot;
      version = &quot;&gt;= 2.4.1&quot;
    }
  }
}

data &quot;aws_eks_cluster&quot; &quot;cluster&quot; {
  name = module.eks-ssp.eks_cluster_id
}

data &quot;aws_eks_cluster_auth&quot; &quot;cluster&quot; {
  name = module.eks-ssp.eks_cluster_id
}

provider &quot;aws&quot; {
  access_key = &quot;xxx&quot;
  secret_key = &quot;xxx&quot;
  region     = &quot;xxx&quot;
  assume_role {
    role_arn = &quot;xxx&quot;
  }
}

provider &quot;kubernetes&quot; {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
  token                  = data.aws_eks_cluster_auth.cluster.token
}

provider &quot;helm&quot; {
  kubernetes {
    host                   = data.aws_eks_cluster.cluster.endpoint
    token                  = data.aws_eks_cluster_auth.cluster.token
    cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
  }
}
</code></pre>
<p>My eks.tf looks like this:</p>
<pre><code>module &quot;eks-ssp&quot; {
    source = &quot;github.com/aws-samples/aws-eks-accelerator-for-terraform&quot;

    # EKS CLUSTER
    tenant            = &quot;DevOpsLabs2b&quot;
    environment       = &quot;dev-test&quot;
    zone              = &quot;&quot;
    terraform_version = &quot;Terraform v1.1.4&quot;

    # EKS Cluster VPC and Subnet mandatory config
    vpc_id             = &quot;xxx&quot;
    private_subnet_ids = [&quot;xxx&quot;,&quot;xxx&quot;, &quot;xxx&quot;, &quot;xxx&quot;]

    # EKS CONTROL PLANE VARIABLES
    create_eks         = true
    kubernetes_version = &quot;1.19&quot;

  # EKS SELF MANAGED NODE GROUPS
    self_managed_node_groups = {
    self_mg = {
      node_group_name        = &quot;DevOpsLabs2b&quot;
      subnet_ids             = [&quot;xxx&quot;,&quot;xxx&quot;, &quot;xxx&quot;, &quot;xxx&quot;]
      create_launch_template = true
      launch_template_os     = &quot;bottlerocket&quot;       # amazonlinux2eks  or bottlerocket or windows
      custom_ami_id          = &quot;xxx&quot;
      public_ip              = true                   # Enable only for public subnets
      pre_userdata           = &lt;&lt;-EOT
            yum install -y amazon-ssm-agent \
            systemctl enable amazon-ssm-agent &amp;&amp; systemctl start amazon-ssm-agent \
        EOT

      disk_size     = 10
      instance_type = &quot;t2.small&quot;
      desired_size  = 2
      max_size      = 10
      min_size      = 0
      capacity_type = &quot;&quot; # Optional Use this only for SPOT capacity as  capacity_type = &quot;spot&quot;

      k8s_labels = {
        Environment = &quot;dev-test&quot;
        Zone        = &quot;&quot;
        WorkerType  = &quot;SELF_MANAGED_ON_DEMAND&quot;
      }

      additional_tags = {
        ExtraTag    = &quot;t2x-on-demand&quot;
        Name        = &quot;t2x-on-demand&quot;
        subnet_type = &quot;public&quot;
      }
      create_worker_security_group = false # Creates a dedicated sec group for this Node Group
    },
  }
}

module &quot;eks-ssp-kubernetes-addons&quot; {
    source = &quot;github.com/aws-samples/aws-eks-accelerator-for-terraform//modules/kubernetes-addons&quot;

    eks_cluster_id                        = module.eks-ssp.eks_cluster_id

    # EKS Addons
    enable_amazon_eks_vpc_cni             = true
    enable_amazon_eks_coredns             = true
    enable_amazon_eks_kube_proxy          = true
    enable_amazon_eks_aws_ebs_csi_driver  = true

    #K8s Add-ons
    enable_aws_load_balancer_controller   = true
    enable_metrics_server                 = true
    enable_cluster_autoscaler             = true
    enable_aws_for_fluentbit              = true
    enable_argocd                         = true
    enable_ingress_nginx                  = true

    depends_on = [module.eks-ssp.self_managed_node_groups]
}
</code></pre>
<p>What exactly am I missing?</p>

TFaws
<p>K8s is hard to get right sometimes. The examples on Github are shown for version <code>1.21</code> [1]. Because of that, if you leave only this:</p>
<pre><code>    enable_amazon_eks_vpc_cni             = true
    enable_amazon_eks_coredns             = true
    enable_amazon_eks_kube_proxy          = true
    enable_amazon_eks_aws_ebs_csi_driver  = true

    #K8s Add-ons
    enable_aws_load_balancer_controller   = true
    enable_metrics_server                 = true
    enable_cluster_autoscaler             = true
    enable_aws_for_fluentbit              = true
    enable_argocd                         = true
    enable_ingress_nginx                  = true
</code></pre>
<p>Images that will be downloaded by default will be the ones for K8s version <code>1.21</code> as shown in [2]. If you really need to use K8s version <code>1.19</code>, then you will have to find the corresponding Helm charts for that version. Here's an example of how you can configure the images you need [3]:</p>
<pre><code>  amazon_eks_coredns_config = {
    addon_name               = &quot;coredns&quot;
    addon_version            = &quot;v1.8.4-eksbuild.1&quot;
    service_account          = &quot;coredns&quot;
    resolve_conflicts        = &quot;OVERWRITE&quot;
    namespace                = &quot;kube-system&quot;
    service_account_role_arn = &quot;&quot;
    additional_iam_policies  = []
    tags                     = {}
  }
</code></pre>
<p>However, the CoreDNS version here (<code>addon_version = v1.8.4-eksbuild.1</code>) is used with K8s <code>1.21</code>. To check the version you would need for <code>1.19</code>, go here [4]. TL;DR: the CoreDNS version you would need to specify is <code>1.8.0</code>. In order to make the add-on work for <code>1.19</code>, for CoreDNS (and other add-ons based on the image version), you would have to have a code block like this:</p>
<pre><code>enable_amazon_eks_coredns             = true
# followed by
  amazon_eks_coredns_config = {
    addon_name               = &quot;coredns&quot;
    addon_version            = &quot;v1.8.0-eksbuild.1&quot;
    service_account          = &quot;coredns&quot;
    resolve_conflicts        = &quot;OVERWRITE&quot;
    namespace                = &quot;kube-system&quot;
    service_account_role_arn = &quot;&quot;
    additional_iam_policies  = []
    tags                     = {}
  }
</code></pre>
<p>For other EKS add-ons, you can find more information here [5]. If you click on the links from the <code>Name</code> column it will lead you straight to the AWS EKS documentation with the add-on image versions supported for the EKS versions currently supported by AWS (<code>1.17</code> - <code>1.21</code>).</p>
<p>Last, but not the least, a friendly advice: <strong>never ever</strong> configure the AWS provider by hard-coding the access key and secret access key in the <code>provider</code> block. Use named profiles [6] or just use the default one. Instead of the block you have currently:</p>
<pre><code>provider &quot;aws&quot; {
  access_key = &quot;xxx&quot;
  secret_key = &quot;xxx&quot;
  region     = &quot;xxx&quot;
  assume_role {
    role_arn = &quot;xxx&quot;
  }
}
</code></pre>
<p>Switch to:</p>
<pre><code>provider &quot;aws&quot; {
  region   = &quot;yourdefaultregion&quot;
  profile  = &quot;yourprofilename&quot;
}
</code></pre>
<hr />
<p>[1] <a href="https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/examples/eks-cluster-with-eks-addons/main.tf#L62" rel="noreferrer">https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/examples/eks-cluster-with-eks-addons/main.tf#L62</a></p>
<p>[2] <a href="https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/modules/kubernetes-addons/aws-kube-proxy/local.tf#L5" rel="noreferrer">https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/modules/kubernetes-addons/aws-kube-proxy/local.tf#L5</a></p>
<p>[3] <a href="https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/examples/eks-cluster-with-eks-addons/main.tf#L148-L157" rel="noreferrer">https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/examples/eks-cluster-with-eks-addons/main.tf#L148-L157</a></p>
<p>[4] <a href="https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html" rel="noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html</a></p>
<p>[5] <a href="https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/docs/add-ons/managed-add-ons.md" rel="noreferrer">https://github.com/aws-samples/aws-eks-accelerator-for-terraform/blob/main/docs/add-ons/managed-add-ons.md</a></p>
<p>[6] <a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html" rel="noreferrer">https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html</a></p>
