Karpenter module tries to re-add empty tags to aws_eks_pod_identity_association

[al-lac]

Description

When using the Karpenter module and using the default tag value which is {} the aws_eks_pod_identity_association always tries to add empty tags.

If your request is for a new feature, please use the Feature request template.

• ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]: 20.24.0

• Terraform version: 1.7.3

• Provider version(s):
  • provider registry.terraform.io/hashicorp/aws v5.64.0
  • provider registry.terraform.io/hashicorp/kubernetes v2.32.0

Reproduction Code [Required]

module "karpenter" {
  source  = "terraform-aws-modules/eks/aws//modules/karpenter"
  version = "~> 20.0"

  cluster_name = module.eks.cluster_name

  enable_v1_permissions = true

  enable_pod_identity             = true
  create_pod_identity_association = true

  # Used to attach additional IAM policies to the Karpenter node IAM role
  node_iam_role_additional_policies = {
    AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  }

  #tags = null
}

Steps to reproduce the behavior:

• Deploy EKS Cluster
• Use Karpenter module
• Run terraform apply

Expected behavior

Terraform should show no changes on the tags.

No changes. Your infrastructure matches the configuration.

Actual behavior

Terraform tries to add the empty tags on every run:

  # module.karpenter.aws_eks_pod_identity_association.karpenter[0] will be updated in-place
  ~ resource "aws_eks_pod_identity_association" "karpenter" {
        id              = "<id>"
      + tags            = {}
        # (7 unchanged attributes hidden)
    }

Terminal Output Screenshot(s)

Additional context

Also mentioned in this issue on the aws provider repo: hashicorp/terraform-provider-aws#37146

Possible solution could be to set the default value to null.

[bryantbiggs]

see #3138 (comment)

[al-lac]

Hey @bryantbiggs, looked into adding the CustomizeDiff: verify.SetTagsDiff to the resource. So far i am not sure how this would work out.

As the issue was closed on the provider and also this one in a different module was closed, I wonder if this will ever be fixed or if just setting the tags to some value of null is enough for now...

[al-lac]

Ok there seems to be another issue open already here: hashicorp/terraform-provider-aws#38173

And also a PR, so hopefully this is fixed soon on the provider level: hashicorp/terraform-provider-aws#38636

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.