aws / aws/containers-roadmap

[EKS] [request]: Enable live reconciliation of managed fiels with EKS Managed Addons

Open
#2,188 3 comments 4 reactions 0 assignees View on GitHub
EKS EKS Add-Ons Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?
A live reconciliation for the managed fiels in EKS Managed Addons.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

Currently, the EKS Managed Addons work with SSA but there doesn't seem to be a live controller in the backend constantly reconciling the state. If the user manually edits/removes a key that is supposedly managed by `eks`, the addon will continue running with that changed state until the next time someone upgrades the addon with the `conflicts` config set to `OVERRIDE `.

I would like that the `OVERRIDE` option to be backed by a live reconciliation of the fields to ensure the addon is properly configured at runtime and not just when I run a `tf apply`, for example.

Another option would be creating a new value - something like `LIVE-OVERRIDE` and make that work as a live controller and leave the `OVERRIDE` option untouched for backwards compatibility purposes.

**Are you currently working around this issue?**
How are you currently solving this problem?

It's currently not possible to achieve this to my knowledge.

**Additional context**
Anything else we should know?

Before the SSA was enabled - in the initial phase for the addons rollout - this live reconciliation used to work and the config for the resource used to be immediately reverted by a controller but this doesn't seem to happen anymore.

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the EKS Managed Addons behavior described here, including server-side apply and the OVERRIDE conflict setting. Determine the intended reconciliation behavior and how it would be validated; done means managed fields are continuously restored at runtime rather than only during a Terraform apply or addon upgrade.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.