Update Terraform cloudposse/eks-iam-role/aws to v2 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/eks-iam-role/aws (source)	module	major	1.1.0 -> 2.0.0

---

Release Notes

cloudposse/terraform-aws-eks-iam-role

v2.0.0

Compare Source

Require correct OIDC Audience value to assume role @​Nuru (#​33)

Breaking Changes

• If namespace and service account are supplied only in service_account_namespace_name_list then the IAM Role name will be derived from the first entry in the list, instead of ending with "all@all"
• If one of service_account_namespace or service_account_name is supplied and the other is not or is empty (""), the missing element will be replaced with a wildcard (*)
• Either or both of service_account_namespace or service_account_name can now be explicitly set to "*" or contain wildcards
• Removed service_account_list_qualifier (invalid/unnecessary)

what

• Created IAM Role's trust policy now includes a check for OIDC aud
• If the generated service account IAM Role Name would be too long, it is now truncated by null-label
• See "Breaking Changes" above
• Terraform minimum version bumped to 1.0.0
• AWS Provider minimum version bumped to 3.0

why

• Extra security, preventing ODIC assertions for one audience being used for another
• Fix rather than break due to too-long IAM Role names
• Role names must be unique, and using "all@all" would limit the cluster to a single multi-namespace role
• "ForAllValues" and "ForAnyValues" are for multi-valued keys. The OIDC keys have single values.

references

• Troubleshooting OIDC and IRSA
• IAM conditions with multiple values

Sync github @​max-lobur (#​32)

Rebuild github dir from the template

v1.3.0

Compare Source

• No changes

v1.2.0

Compare Source

Feature: Namespace and Name List @​Benbentwo (#​31)

what

• supports a list of any or all value list

why

• Allows multiple various namespace and name patterns that couldn't be matched except with a singular *:*

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.