[Bug]: String length check needed for aws_iam_role.irsa name in module kubernetes-addons

[gmirsky]

Welcome to Amazon SSP EKS Accelerator!

• Yes, I've searched similar issues on GitHub and didn't find any.

Amazon EKS Accelerator Release version

v3.5.0

What is your environment, configuration and the example used?

Terraform v1.1.7

What did you do and What did you see instead?

Cluster name was mri-dbg-gen-566646271983 but the underlying module tried to create a name larger than 64 characters causing the terraform apply to fail. Some sort of length check needs to be implemented for name on line 47.

Error: expected length of name to be in the range (1 - 64), got mri-dbg-gen-566646271983-eks-aws-load-balancer-controller-sa-irsa

   with module.kubernetes-addons.module.aws_load_balancer_controller[0].module.helm_addon.module.irsa[0].aws_iam_role.irsa[0],
   on .terraform\modules\kubernetes-addons\modules\irsa\main.tf line 47, in resource "aws_iam_role" "irsa":
   47:   name        = format("%s-%s-%s", var.addon_context.eks_cluster_id, trim(var.kubernetes_service_account, "-*"), "irsa")

Additional Information

No response

[askulkarni2]

Hi @gmirsky, thanks for reporting this issue. I've created an issue for tracking this.

[vara-bonthu]

All the IAM roles and policies are prefixed with EKS Cluster names for better identification and making it unique to the cluster.

We need to add checks for the following resources that cannot exceed 64 characters length

• EKS Cluster name
• Managed node_group_name
• fargate_profile_name
• IAM Roles names
• IAM Policy names

[dcarbone]

A counter point to that: allow the name to be configured via a variable.

64 characters is very limiting, especially when the suffix -aws-load-balancer-controller-sa-irsa is always applied and non-configurable.

I am running into a scenario where the eks_cluster_id value can be upwards of 50 characters in length which, when the statically defined 37 character suffix is appended, blows way past the 64 character limit.

I would further argue that it is not this module's place to enforce a naming convention onto its userbase. Suggest one, definitely, but not force.

[sbathgate]

For visibility, I just ran into this too. After getting everything else configured, I went to add the load-balancer only to discover I have ... 65 characters naturally. If the current format is to continue it would be great to add a check that the eks_cluster_id does not exceed the 25 characters or so limit that would block certain addons.