chore(deps): update terraform cloudposse/eks-cluster/aws to v4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/eks-cluster/aws (source)	module	major	3.0.0 → 4.9.0

---

Release Notes

cloudposse/terraform-aws-eks-cluster (cloudposse/eks-cluster/aws)

v4.9.0

Compare Source

feat: add EKS Auto Mode support @​Benbentwo (#​259)

Summary

• Add compute_config, storage_config, and elastic_load_balancing object variables for fully configurable Auto Mode support
• Add dynamic blocks for compute_config, storage_config, and elastic_load_balancing on aws_eks_cluster
• Add sts:TagSession to cluster role trust policy when Auto Mode enabled
• Attach 4 Auto Mode cluster IAM policies (AmazonEKSComputePolicy, AmazonEKSBlockStoragePolicy, AmazonEKSLoadBalancingPolicy, AmazonEKSNetworkingPolicy)
• Add auto_mode_enabled output
• Add consistency check ensuring all three capabilities are toggled together
• Auto-set bootstrap_self_managed_addons = false when Auto Mode is enabled
• Bump AWS provider minimum to >= 5.79.0

All defaults preserve current behavior -- this is additive and non-breaking.

Test plan

• terraform validate passes (verified locally)
• terraform plan on existing cluster shows no changes (backward compat)
• Deploy new cluster with Auto Mode enabled, verify via aws eks describe-cluster
• Verify cluster IAM role has Auto Mode policies attached
• Verify bootstrap_self_managed_addons is correctly auto-set

🤖 Generated with Claude Code

v4.8.0

Compare Source

Feat: Add remote_network_config configuration @​mszczepanczyk-soprasteria (#​258)

what

• Add configuration for remote node and pod networks

why

• Support for hybrid nodes
• We use it in combination with Cilium in overlay mode so that the cluster correctly recognizes IPs in cilium pod CIDR as pods

references

• https://docs.aws.amazon.com/eks/latest/userguide/hybrid-nodes-cluster-create.html
• https://medium.com/@​the.jfnadeau/eks-cilium-as-the-only-cni-driver-with-simplified-hybrid-nodes-and-admission-webhooks-routing-1f351d11f9dd

v4.7.0

Compare Source

feat: add pod identity association support for EKS addons @​litanyofmadness (#​256)

what

• Added pod_identity_association parameter to EKS addons configuration
• Maps service account names to IAM role ARNs for pod identity authentication
• Maintains backward compatibility with existing configurations

why

• Enables modern IAM authentication for EKS addons using pod identities
• Aligns with AWS best practices for EKS

references

Terraform EKS Addon Pod Identity: Docs
Closes: #​252

🤖 Automatic Updates

Fix go version in tests @​osterman (#​255)

what

• Update go 1.24

why

• Error loading shared library libresolv.so.2 in Go 1.20

References

• https://sweetops.slack.com/archives/G014YEKDH4K/p1746672149263629
• https://github.com/golang/go/issues/59305#issuecomment-1488478737
• https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/pull/294/#issuecomment-2859195553

Replace Makefile with atmos.yaml @​osterman (#​254)

what

• Remove Makefile
• Add atmos.yaml

why

• Replace build-harness with atmos for readme genration

References

• DEV-3229 Migrate from build-harness to atmos

v4.6.0

Compare Source

🚀 Enhancements

• Allow extra tags specific to addons
• Make access_scope optional in access_policy_associations

Enhancements (#​250)

what

• Ensure access entries are created before associating them with policies
• Allow extra tags specific to addons
• Make access_scope optional in access_policy_associations
• Add testing for enabled=false
• Fix typo in hyperlink

why

• Some addons require specific tags for configuration
• All the elements of access_scope are optional, so access_scope itself is not required

references

• Supersedes and closes #​230
• Supersedes and closes #​233
• Closes #​247
• Closes #​248

🐛 Bug Fixes

• Ensure access entries are created before associating them with policies
• Add testing for enabled=false
• Fix typo in hyperlink

Bugfixes @​Nuru (#​250)

what

• Ensure access entries are created before associating them with policies
• Add testing for enabled=false
• Fix typo in hyperlink

why

• Race condition can cause cluster creation to fail if Terraform attempts to create access entries and policy associations in parallel
• Standard testing requirement, ensure no resources are created and module functions without error when enabled=false
• Fix typo

references

• Supersedes and closes #​230
• Supersedes and closes #​233
• Closes #​247
• Closes #​248

v4.5.0

Compare Source

Add support for upgrade policy configuration @​z0rc (#​245)

what

Add module variable to set aws_eks_cluster's upgrade_policy.

why

I need to be able to downgrade EKS support policy from default "Extedned" to "Standard".

references

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#upgrade_policy

https://aws.amazon.com/about-aws/whats-new/2024/07/amazon-eks-controls-kubernetes-version-support-policy/

Summary by CodeRabbit

• New Features

  • Introduced a new input parameter upgrade_policy for configuring the support policy of the EKS cluster.
  • Added a new variable zonal_shift_config to the Terraform configuration.

• Documentation

  • Updated README and Terraform documentation to include details about the new upgrade_policy input.
  • Enhanced clarity and comprehensiveness of existing inputs and outputs documentation.
  • Added examples for the upgrade_policy configuration in the fixtures and variable files.

• Bug Fixes

  • Updated default values for existing variables to improve clarity and usability.

v4.4.1

Compare Source

Add support for zonal shift configuration @​z0rc (#​243)

what

Add support of zonal shift config for the cluster. Closes #​242

why

See linked ticket.

references

See linked ticket.

additional info

<br> to <br/> changes are caused by new version of terraform-docs and are intended, see terraform-docs/terraform-docs#787

🤖 Automatic Updates

Update terratest to '>= 0.46.0' @​osterman (#​232)

what

• Update terratest >= 0.46.0

why

• Support OpenTofu for testing

References

• https://github.com/gruntwork-io/terratest/releases/tag/v0.46.0
• DEV-374 Add opentofu to all our Terragrunt Testing GHA matrix

Migrate new test account @​osterman (#​240)

what

• Update .github/settings.yml
• Update .github/chatops.yml files

why

• Re-apply .github/settings.yml from org level to get terratest environment
• Migrate to new test account

References

• DEV-388 Automate clean up of test account in new organization
• DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
• DEV-386 Update terratest to use new testing account with GitHub OIDC

Update .github/settings.yml @​osterman (#​239)

what

• Update .github/settings.yml
• Drop .github/auto-release.yml files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

Update .github/settings.yml @​osterman (#​238)

what

• Update .github/settings.yml
• Drop .github/auto-release.yml files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

v4.4.0

Compare Source

🚀 Enhancements

feat: Add support bootstrap_self_managed_addons @​sergeyrudenko111 (#​236)

what

• Add support of bootstrap_self_managed_addons for aws_eks_cluster resource

why

• This change will provide an opportunity to not bootstrap default networking addons for new cluster

references

https://aws.amazon.com/about-aws/whats-new/2024/06/amazon-eks-cluster-creation-flexibility-networking-add-ons/

v4.3.0

Compare Source

feat: Add missed tags @​MaxymVlasov (#​235)

what

Add tags to resources where they missed

🤖 Automatic Updates

Update .github/settings.yml @​osterman (#​234)

what

• Update .github/settings.yml
• Drop .github/auto-release.yml files

why

• Re-apply .github/settings.yml from org level
• Use organization level auto-release settings

references

• DEV-1242 Add protected tags with Repository Rulesets on GitHub

v4.2.0

Compare Source

add cloudwatch_log_group_class config @​peter-novata (#​229)

what

• Add configuration option for the cloudwatch log infrequent access

why

terraform AWS provider added support for the recent cloudwatch log infrequent access feature which reduces cloudwatch log costs by up to 50%

references

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group.html#log_group_class
https://aws.amazon.com/blogs/aws/new-amazon-cloudwatch-log-class-for-infrequent-access-logs-at-a-reduced-price/

🤖 Automatic Updates

Update release workflow to allow pull-requests: write @​osterman (#​231)

what

• Update workflow (.github/workflows/release.yaml) to have permission to comment on PR

why

• So we can support commenting on PRs with a link to the release

Update GitHub Workflows to use shared workflows from '.github' repo @​osterman (#​228)

what

• Update workflows (.github/workflows) to use shared workflows from .github repo

why

• Reduce nested levels of reusable workflows

v4.1.1

Compare Source

Add Service IPv4 CIDR to output @​z0rc (#​227)

what

Implements #​226.

why

See linked issue.

references

See linked issue.

Fix badges @​goruha (#​224)

what

• Fix badges

why

• We have to many latest update badges

Update readme workflows @​goruha (#​223)

what

• Update readme workflows

why

• Generate banners

Update/enhance migration documentation @​Nuru (#​218)

what

• Update/enhance v3 to v4 migration documentation
• Add .editorconfig

why

• Add more information that may be helpful
• Maintain consistent formatting, particularly with regard to line endings and trailing whitespace, reducing the number of meaningless changes introduced when editing

🚀 Enhancements

Bump github.com/hashicorp/go-getter from 1.7.3 to 1.7.4 in /test/src @​dependabot (#​222)

Bumps github.com/hashicorp/go-getter from 1.7.3 to 1.7.4.

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.4

What's Changed

• Escape user-provided strings in git commands hashicorp/go-getter#483
• Fixed a bug in .netrc handling if the file does not exist hashicorp/go-getter#433

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4

Commits

• 268c11c escape user provide string to git (#​483)
• 975961f Merge pull request #​433 from adrian-bl/netrc-fix
• 5ccb39a Make addAuthFromNetrc ignore ENOTDIR errors
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

🤖 Automatic Updates

Update GitHub Workflows to Fix ReviewDog TFLint Action @​osterman (#​225)

what

• Update workflows (.github/workflows) to add issue: write permission needed by ReviewDog tflint action

why

• The ReviewDog action will comment with line-level suggestions based on linting failures

Bump golang.org/x/net from 0.21.0 to 0.23.0 in /test/src @​dependabot (#​221)

Bumps golang.org/x/net from 0.21.0 to 0.23.0.

Commits

• c48da13 http2: fix TestServerContinuationFlood flakes
• 762b58d http2: fix tipos in comment
• ba87210 http2: close connections when receiving too many headers
• ebc8168 all: fix some typos
• 3678185 http2: make TestCanonicalHeaderCacheGrowth faster
• 448c44f http2: remove clientTester
• c7877ac http2: convert the remaining clientTester tests to testClientConn
• d8870b0 http2: use synthetic time in TestIdleConnTimeout
• d73acff http2: only set up deadline when Server.IdleTimeout is positive
• 89f602b http2: validate client/outgoing trailers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Bump github.com/hashicorp/go-getter from 1.7.3 to 1.7.4 in /test/src @​dependabot (#​222)

Bumps github.com/hashicorp/go-getter from 1.7.3 to 1.7.4.

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.4

What's Changed

• Escape user-provided strings in git commands hashicorp/go-getter#483
• Fixed a bug in .netrc handling if the file does not exist hashicorp/go-getter#433

Full Changelog: https://github.com/hashicorp/go-getter/compare/v1.7.3...v1.7.4

Commits

• 268c11c escape user provide string to git (#​483)
• 975961f Merge pull request #​433 from adrian-bl/netrc-fix
• 5ccb39a Make addAuthFromNetrc ignore ENOTDIR errors
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

chore(deps): update all @​renovate (#​220)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/dynamic-subnets/aws (source)	module	patch	2.4.1 -> 2.4.2
cloudposse/vpc/aws (source)	module	minor	2.1.1 -> 2.2.0

---

Release Notes

cloudposse/terraform-aws-dynamic-subnets (cloudposse/dynamic-subnets/aws)

v2.4.2

Compare Source

🚀 Enhancements

chore(deps): update terraform cloudposse/utils/aws to v1.4.0 (main) @​&#​8203;renovate (#&#​8203;191)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/utils/aws (source)	module	minor	1.3.0 -> 1.4.0

---

Release Notes

cloudposse/terraform-aws-utils (cloudposse/utils/aws)

v1.4.0

Compare Source

Add il-central-1 region @​&#​8203;&#&#​8203;8203;jasonmk (#&#&#​8203;8203;31)

what

Add new Tel Aviv (il-central-1) region

why

Provide full coverage

references

Sync github @​&#​8203;&#&#​8203;8203;max-lobur (#&#&#​8203;8203;27)

Rebuild github dir from the template

---

🤖 Automatic Updates

chore(deps): update terraform cloudposse/utils/aws to v1.4.0 (main) @​&#​8203;renovate (#&#​8203;191)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/utils/aws (source)	module	minor	1.3.0 -> 1.4.0

---

Release Notes

cloudposse/terraform-aws-utils (cloudposse/utils/aws)

v1.4.0

Compare Source

Add il-central-1 region @​&#​8203;&#&#​8203;8203;jasonmk (#&#&#​8203;8203;31)

what

Add new Tel Aviv (il-central-1) region

why

Provide full coverage

references

Sync github @​&#​8203;&#&#​8203;8203;max-lobur (#&#&#​8203;8203;27)

Rebuild github dir from the template

---

Update README.md and docs @​&#​8203;cloudpossebot (#&#​8203;189)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

cloudposse/terraform-aws-vpc (cloudposse/vpc/aws)

v2.2.0

Compare Source

---

Use GitHub Action Workflows from `cloudposse/.github` Repo @​osterman (#​219)

what

• Install latest GitHub Action Workflows

why

• Use shared workflows from cldouposse/.github repository
• Simplify management of workflows from centralized hub of configuration

v4.1.0

Compare Source

Update readme @​osterman (#​208)

what

• Update readme.md

why

• Latest copy

🚀 Enhancements

Output addons_versions if enabled @​bogdanbarna (#​216)

what

• Output addons_version if the EKS addons are enabled (var.addons)

why

• This may be just my use case, but I have both a variable and a data source for fetching an addon version (the former to overwrite the latter) and the module's addon_version output would become the source of truth for the versions, e.g.

addon_version = try(var.addons_versions["coredns"], data.aws_eks_addon_version.latest["coredns"].version)

references

• N/A

🤖 Automatic Updates

Add GitHub Settings @​osterman (#​215)

what

• Install a repository config (.github/settings.yaml)

why

• Programmatically manage GitHub repo settings

Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /test/src @​dependabot (#​213)

Bumps google.golang.org/protobuf from 1.32.0 to 1.33.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

v4.0.0: Major breaking changes

Compare Source

Major breaking changes. Review the migration guide for guidance about upgrading.

In this version we fulfill the promise of managing EKS access via AWS APIs rather than via the various hacks we employed to make it possible to manage access via the aws-auth ConfigMap. As a result, all references to the Kubernetes Terraform AWS provider have been removed, requiring manual intervention for upgrading from previous versions.

We also removed Security Group and other inputs deprecated in version 2.

We believe the final result is much cleaner, more reliable, and more stable than earlier versions, but the upgrade is unfortunately non-trivial. Please allow yourself sufficient time to read the migration guide before upgrading.

Use AWS API for EKS authentication and authorization @​Nuru (#​206)

Major Breaking Changes

[!WARNING]
This release has major breaking changes and requires significant manual intervention
to upgrade existing clusters. Read the migration document
for more details.

what

• Use the AWS API to manage EKS access controls instead of the aws-auth ConfigMap
• Remove support for creating an extra security group, deprecated in v2
• Add IPv6 service CIDR output
• Update test framework to go v1.21, Kubernetes 1.29, etc.

why

• Remove a large number of bugs, hacks, and flaky behaviors
• Encourage separation of concerns (use another module to create a security group)
• Requested and authored by @​colinh6
• Stay current

references

• New API for EKS access control
• Obsoletes and closes #​148
• Obsoletes and closes #​155
• Obsoletes and closes #​167
• Obsoletes and closes #​168
• Obsoletes and closes #​193
• Obsoletes and closes #​202
• Fixes #​203
• Supersedes and closes #​173
• Supersedes and closes #​194
• Supersedes and closes #​195
• Supersedes and closes #​196
• Supersedes and closes #​197
• Supersedes and closes #​198
• Supersedes and closes #​199
• Supersedes and closes #​200
• Supersedes and closes #​201

Update readme @​osterman (#​204)

what

• Update to use new readme

why

• Fresh copy

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

/terratest