IRSA, Thumbprint list must contain fewer than 5 entries

[atre]

Is your request related to a problem? Please describe.

I'm working on IRSA and I'm getting this
Error: creating IAM OIDC Provider: InvalidInput: Thumbprint list must contain fewer than 5 entries.

I'm also using two additional entries in custom_oidc_thumbprints

So due to this concatenation

terraform-aws-eks/main.tf

Line 235 in f741db1

thumbprint_list = concat(data.tls_certificate.this[0].certificates[*].sha1_fingerprint, var.custom_oidc_thumbprints)

I can't apply configuration in any environment with more than 3 certificates in the chain

Describe the solution you'd like.

I want to discuss possible fixes and work on these. I see following

1. Prioritise custom_oidc_thumbprints over those that have been added from the datasource. Maybe add a switch to just add custom_oidc_thumbprints?

2. Slice resulting thumbprint_list to 5 entries, from the end

3. Add validation here so no more 5 entries can be in a list
   

   terraform-aws-eks/variables.tf

   Lines 361 to 365 in f741db1

   	variable "custom_oidc_thumbprints" {
   	description = "Additional list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s)"
   	type = list(string)
   	default = []
   	}

Additional context

Last related commit from @ThetaSinner
7436178

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days

[Constantin07]

Up to avoid stale.

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days

[github-actions]

This issue was automatically closed because of stale in 10 days

[gabegorelick]

Related to hashicorp/terraform-provider-aws#32847. I think #2307 was a mistake. It updated the thumbprint list to be in line with Terraform's recommendations, but then Terraform realized that probably wasn't a good idea.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.