My launch template specifies an iam instance profile and my node group has a groupe role arn. Based on this error, I removed the iam_instance_role argument from my template resource block and it still gave me the same error

Launch template mtc should not specify an instance profile. The noderole in your request will be used to construct an instance profile."

Here's my launch template resource blocks with my instance profile included

resource "aws_launch_template" "node" {
  image_id                             = var.image_id
  instance_type                        = var.instance_type
  key_name                             = var.key_name
  instance_initiated_shutdown_behavior = "terminate"
  name                                 = var.name
  user_data                            = base64encode("node_userdata.tpl")
#   vpc_security_group_ids               = var.security_group_ids

    block_device_mappings {
        device_name = "/dev/sda1"

    ebs {
      volume_size = 20
    }
  }

  iam_instance_profile {
    name = aws_iam_instance_profile.node.name
  }

  monitoring {
    enabled = true
  }
}

resource "aws_iam_instance_profile" "node" {
  name_prefix = var.name
  role        = aws_iam_role.node.id
}

resource "aws_iam_role" "node" {
  assume_role_policy = data.aws_iam_policy_document.assume_role_ec2.json
  name               = var.name
}

data "aws_iam_policy_document" "assume_role_ec2" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"

    principals {
      identifiers = ["ec2.amazonaws.com"]
      type        = "Service"
    }
  }
}

When I first tried to apply this I got that error, so I removed all of it and tried again without the instance profile like-so:

resource "aws_launch_template" "node" {
  image_id                             = var.image_id
  instance_type                        = var.instance_type
  key_name                             = var.key_name
  instance_initiated_shutdown_behavior = "terminate"
  name                                 = var.name
  user_data                            = base64encode("node_userdata.tpl")
#   vpc_security_group_ids               = var.security_group_ids

    block_device_mappings {
        device_name = "/dev/sda1"

    ebs {
      volume_size = 20
    }
  }

  monitoring {
    enabled = true
  }
}

Got the same error both times. Here's my node group resource block as well

resource "aws_eks_node_group" "nodes_eks" {

  cluster_name    = aws_eks_cluster.eks.name
  node_group_name = "eks-node-group"
  node_role_arn   = aws_iam_role.eks_nodes.arn
  subnet_ids      = module.vpc.private_subnets
  # remote_access {
  #   ec2_ssh_key = aws_key_pair.bastion_auth.id

  # }

  scaling_config {
    desired_size = 3
    max_size     = 6
    min_size     = 3
  }

  ami_type             = "CUSTOM"
  capacity_type        = "ON_DEMAND"

  force_update_version = false
  # instance_types       = [var.instance_type]
  labels = {
    role = "nodes-pool-1"
  }

  launch_template {
    id      = aws_launch_template.node.id
    version = aws_launch_template.node.default_version
  }

  # version = var.k8s_version

  depends_on = [
    aws_iam_role_policy_attachment.amazon_eks_worker_node_policy,
    aws_iam_role_policy_attachment.amazon_eks_cni_policy,
    aws_iam_role_policy_attachment.amazon_ec2_container_registry_read_only,
  ]
}

CodePudding user response：

In this case, there are multiple points to take care of starting with [1]:

An object representing a node group launch template specification. The launch template cannot include SubnetId, IamInstanceProfile, RequestSpotInstances, HibernationOptions, or TerminateInstances, or the node group deployment or update will fail.

As per the document [2], you cannot specify any of the:

1. Instance profile - the node IAM role will be used

2. Subnets - the subnet_ids will be used and they are defined also in the node configuration

3. Shutdown behavior - EKS controls the instance lifecycle

Note that in the table it says prohibited which means it cannot ever be used. Additionally, in [2], you can find this as well:

Some of the settings in a launch template are similar to the settings used for managed node configuration. When deploying or updating a node group with a launch template, some settings must be specified in either the node group configuration or the launch template. Don't specify both places. If a setting exists where it shouldn't, then operations such as creating or updating a node group fail.

So you were pretty close when you removed the iam_instance_profile, but you still have to get rid of the instance_initiated_shutdown_behavior argument:

resource "aws_launch_template" "node" {
  image_id       = var.image_id
  instance_type  = var.instance_type
  key_name       = var.key_name
  name           = var.name
  user_data      = base64encode("node_userdata.tpl")

  block_device_mappings {
    device_name = "/dev/sda1"

    ebs {
      volume_size = 20
    }
  }

  monitoring {
    enabled = true
  }
}

I strongly suggest reading through the second document as it contains a lot of useful information about what to do when using a custom AMI.

[1] https://docs.aws.amazon.com/eks/latest/APIReference/API_LaunchTemplateSpecification.html

[2] https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-basics