Sign in
agent:

Ensure OIDC provider URL and Service Account issuer URL are different before upgrading to EKS v1.30

There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

Before upgrading an EKS cluster to v1.30, verify that the OIDC provider URL used for IAM authentication is different from the Service Account issuer URL. If they are the same, disassociate the identity provider to avoid API server startup failures due to new validation in Kubernetes v1.30.

By default both have the same value: A AWS managed OIDC Provider [which leads to version update issues >>> Kube API server failing]

  1. 1

    Get current Service Account Issuer URL to EKS Cluster

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

    This is generated by default when the EKS cluster is created

    aws eks describe-cluster --region <region_name> --name <cluster_name> \ --query "cluster.identity.oidc.issuer" --output text
    copied
    1

  2. 2

    List IAM OIDC Provider ARN for the custer

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    aws iam list-open-id-connect-providers --region <region_name>
    copied
    2

  3. 3

    Backup IAM OIDC Provider ARN(optional)

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    aws iam get-open-id-connect-provider \ --open-id-connect-provider-arn <oidc_provider_arn> \ --region <region_name> \ --output json > <filename>
    copied
    3

  4. 4

    List IAM roles using OIDC provider

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

    For Prod Cluster: (Roles with OIDC usage)

    eks-prod-341-alb-ingress

    eks-prod-341-efs-csi-driver

    aws iam list-roles --query 'Roles[*].{RoleName:RoleName,OIDC_Provider:AssumeRolePolicyDocument.Statement[].Principal.Federated}' --output json | jq .
    copied
    4

  5. 5

    List Identity Provider Config

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

    This should come up as empty for now.

    aws eks list-identity-provider-configs \ --region <region_name> \ --cluster-name <cluster_name>
    copied
    5

  6. 6

    Delete old IAM oidc identity provider

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    aws iam delete-open-id-connect-provider \ --open-id-connect-provider-arn <oidc_provider_arn>
    copied
    6

  7. 7

    Creating a new OIDC provider using AWS Cognito

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    7

    1. 7.1

      Create user pool in AWS Cognito

      There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
      aws cognito-idp create-user-pool \ --pool-name <oidc_pool_name> \ --region <region_name>
      copied
      7.1

    2. 7.2

      Create an app client for AWS cognito using the user_id from previously created user-pool

      There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
      aws cognito-idp create-user-pool-client \ --user-pool-id <user_pool_id> \ --client-name eks-client \ --no-generate-secret \ --region <region_name>
      copied
      7.2

    3. 7.3

      Create an IAM OIDC Provider Using AWS Cognito

      There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
      aws iam create-open-id-connect-provider \ --url <provider_url_cognito> \ --client-id-list "sts.amazonaws.com" \ --thumbprint-list $(openssl s_client -servername cognito-idp.us-east-2.amazonaws.com -connect cognito-idp.us-east-2.amazonaws.com:443 </dev/null 2>/dev/null | openssl x509 -fingerprint -sha1 -noout | cut -d"=" -f2) \ --region <region_name>
      copied
      7.3

    4. 7.4

      Associating Cognito OIDC provider with EKS Cluster

      There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
      aws eks associate-identity-provider-config \ --region <region_name> \ --cluster-name <cluster_name> \ --oidc identityProviderConfigName="eks-oidc-cognito",issuerUrl=<provider_url_cognito>,clientId=<client_id>
      copied
      7.4

  8. 8

    Remove old oidc from required eks statefile

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

    Use terraform state list | grep "oidc_provider" to find the required state file items.

    terraform state rm module.eks.aws_iam_openid_connect_provider.oidc_provider[0]
    copied
    8

  9. 9

    Run Terraform Import to sync the manually created Cognito User Pool into Terraform state

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

    Use arn to import if facing issues, correlate name from main.tf file

    terraform import \ -var environment=<env_name> \ -var aws_region=<region_name> \ -var remote_state_bucket=<s3_backend_bucket> \ -var remote_state_region=<backend_region> \ aws_cognito_user_pool.eks_user_pool <user_pool_name>
    copied
    9

  10. 10

    Add the following code blocks in eks/main.tf outside the eks module

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    data "tls_certificate" "cognito_oidc_thumbprint" { url = "https://cognito-idp.us-east-2.amazonaws.com/${data.aws_cognito_user_pool.eks_user_pool.id}" } data "aws_cognito_user_pool" "eks_user_pool" { user_pool_id = <user_pool_id> } resource "aws_iam_openid_connect_provider" "eks_oidc" { client_id_list = ["sts.amazonaws.com"] thumbprint_list = [data.tls_certificate.cognito_oidc_thumbprint.certificates[0].sha1_fingerprint] url = "https://cognito-idp.us-east-2.amazonaws.com/${data.aws_cognito_user_pool.eks_user_pool.user_pool_id}" } resource "aws_eks_identity_provider_config" "eks_oidc" { cluster_name = module.eks.cluster_name oidc { identity_provider_config_name = "eks-oidc-cognito" issuer_url = "https://${aws_iam_openid_connect_provider.eks_oidc.url}" client_id = <client_id> } depends_on = [aws_iam_openid_connect_provider.eks_oidc] }
    copied
    10

  11. 11

    Import the existing Cognito-EKS association into Terraform

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    terraform import \ -var environment=<env_name> \ -var aws_region=<region_name> \ -var remote_state_bucket=<s3_backend_bucket> \ -var remote_state_region=<backend_region> \ aws_eks_identity_provider_config.eks_oidc <cluster_name>:<oidc_name_cognito>
    copied
    11

  12. 12

    Add below lines in eks/main.tf in the eks module to not let terraform create irsa roles and provider by default

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    enable_irsa = false cluster_identity_providers = {}
    copied
    12

  13. 13

    Do a terraform init, plan and apply cycle for eks module so new outputs of eks module are propogated

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.

    cluster_oidc_issuer_url: aws based oidc

    oidc_provider_arn: cognito based

    Should be different now.

    terraform init \ -backend-config=<backend_s3_bucket> \ -backend-config=<dynamo_db_lock_name> \ -backend-config=<statefile_key> \ -backend-config="encrypt=true" \ -backend-config="region=us-east-2" terraform apply \ -var environment=<env_name> \ -var aws_region=<region_name> \ -var remote_state_bucket=<backend_s3_bucket> \ -var remote_state_region=<backend_region> # Same apply usage for plan as well
    copied
    13

  14. 14

    Do a terraform init, plan and apply cycle for eks-services module so new outputs of eks module are used for IAM Role creation

    There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
    terraform init \ -backend-config=<backend_s3_bucket> \ -backend-config=<dynamo_db_lock_name> \ -backend-config=<statefile_key> \ -backend-config="encrypt=true" \ -backend-config="region=us-east-2" terraform apply \ -var environment=<env_name> \ -var aws_region=<region_name> \ -var remote_state_bucket=<backend_s3_bucket> \ -var remote_state_region=<backend_region> # Same apply usage for plan as well
    copied
    14

AI created and expert curated runbooks

© 2025 DagKnows, Inc. All rights reserved
Resources
Blog
Company
Legal
Privacy policy