EKS Capability

The capability sub-module creates the AWS resources required to install an EKS Capability onto an existing cluster. EKS Capabilities are AWS-managed add-ons that integrate popular open-source tools directly into EKS.

Supported capability types

Type	Description
`ACK`	AWS Controllers for Kubernetes — manage AWS services via Kubernetes custom resources
`ARGOCD`	Argo CD — GitOps continuous delivery with AWS Identity Center (SSO) integration
`KRO`	Kubernetes Resource Orchestrator — compose and deploy complex Kubernetes resource groups

Usage

ACK
ArgoCD
KRO

module "ack_eks_capability" {
  source  = "terraform-aws-modules/eks/aws//modules/capability"
  version = "~> 21.0"

  type         = "ACK"
  cluster_name = module.eks.cluster_name

  # IAM Role/Policy
  iam_role_policies = {
    AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
  }

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

ArgoCD requires AWS Identity Center (SSO) configuration.

module "argocd_eks_capability" {
  source  = "terraform-aws-modules/eks/aws//modules/capability"
  version = "~> 21.0"

  type         = "ARGOCD"
  cluster_name = module.eks.cluster_name

  configuration = {
    argo_cd = {
      aws_idc = {
        idc_instance_arn = "arn:aws:sso:::instance/ssoins-1234567890abcdef0"
      }
      namespace = "argocd"
      rbac_role_mapping = [{
        role = "ADMIN"
        identity = [{
          id   = "686103e0-f051-7068-b225-e6392b959d9e"
          type = "SSO_GROUP"
        }]
      }]
    }
  }

  iam_policy_statements = {
    ECRRead = {
      actions = [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
      ]
      resources = ["*"]
    }
  }

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

module "kro_eks_capability" {
  source  = "terraform-aws-modules/eks/aws//modules/capability"
  version = "~> 21.0"

  type         = "KRO"
  cluster_name = module.eks.cluster_name

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

Key inputs

string

required

The capability type. Valid values: ACK, ARGOCD, KRO.

string

required

The name of the EKS cluster to install the capability on.

bool

default:"true"

Controls whether resources are created. Set to false to disable the module without removing it from configuration.

object

default:"null"

Capability-specific configuration. Currently only used for ARGOCD type.

Show ARGOCD configuration fields

string

required

ARN of the AWS Identity Center instance.

string

Region of the AWS Identity Center instance. Defaults to the provider region.

string

Kubernetes namespace where ArgoCD is installed. Defaults to argocd.

list(object)

List of role mappings from AWS Identity Center groups/users to ArgoCD RBAC roles.

list(string)

List of VPC endpoint IDs for private access to the ArgoCD server.

string

default:""

Name for the capability. Defaults to an empty string (uses module key).

string

default:"null"

AWS region. Defaults to the provider region.

IAM role inputs

map(string)

default:"{}"

Map of IAM managed policy ARNs to attach to the capability IAM role. Key is a static label; value is the policy ARN.

map(object)

Map of inline IAM policy statements to create and attach to the capability IAM role.

string

default:"null"

Override name for the IAM role. Defaults to derived from capability type and cluster name.

bool

default:"true"

Whether to use iam_role_name as a name prefix.

string

default:"null"

ARN of a permissions boundary policy to attach to the IAM role.

map(string)

default:"{}"

Map of tags to apply to all resources created.

Outputs

string

The ARN of the EKS Capability.

string

The version of the installed EKS Capability.

string

URL of the Argo CD server. Only populated when type = "ARGOCD".

string

The name of the IAM role created for the capability.

string

The ARN of the IAM role created for the capability.

string

Stable and unique string identifying the IAM role.

Notes

The capability sub-module requires the EKS cluster to be active before installing capabilities. Ensure the root module.eks is created before referencing module.eks.cluster_name in the capability module.

For ARGOCD type, your AWS account must have AWS Identity Center (IAM Identity Center / SSO) enabled. The idc_instance_arn must match the region where your Identity Center is configured (typically us-east-1).

Get Started

Compute Resources

Configuration

Sub-Modules

Examples

Operations

Supported capability types

Usage

Key inputs

IAM role inputs

Outputs

Notes

​Supported capability types

​Usage

​Key inputs

​IAM role inputs

​Outputs

​Notes

Supported capability types

Usage

Key inputs

IAM role inputs

Outputs

Notes