Tagging on ASG resource in EKS cluster

[zitrocy]

Hi,

I am currently looking to add tags to existing EKS resources within my cluster. Specifically, I want to add a Name tag, but I have encountered a few issues and would appreciate some guidance.

For context, I want to ensure that I do not remove any existing tags. Here is an example scenario:

• Some resources already have the Name tag, while others do not.

• I do not want to delete the existing Name tags where they are already present.

I referred to this article (Tag issue on aws_autoscaling_group resource – HashiCorp Help Center), which explains some related issues, but I still need further assistance.

When I use for_each to add tags, the existing resources seem to be destroyed and then recreated. Here is an example of the output I see:

'# module.eks_cluster.aws_autoscaling_group_tag.this will be destroyed
'# (because resource uses count or for_each)

In my root module, the configuration is as follows:

module "eks_cluster" {
  cluster_name       = <eks-cluster-name>
  node_group_name    = <node group-name>
  eks_version        = "1.xx"
  tags               = merge(local.tags, { "Service" = local.service_name, "CreatedBy" = "terraform" })
  ...
}

The aws_autoscaling_group_tag module is configured similarly to the article. Instead of using count, I tried using for_each to apply the tags, but this results in the resource being removed and recreated, which I want to avoid.

Here is an example configuration for the aws_autoscaling_group_tag resource:
(Following is not my child module.)

resource "aws_autoscaling_group_tag" "cluster_owned" {
  count = var.enable_windows_workers ? 1 : 0
  autoscaling_group_name = aws_autoscaling_group.worker_windows[0].name

  tag {
    key   = "kubernetes.io/cluster/${var.cluster_name}"
    value = "owned"
    propagate_at_launch = true
  }
}

Could you please advise on the best way to add tags to existing EKS resources without causing the existing tags to be removed or the resources to be recreated?

Thank you for your assistance.

[apparentlymart]

Hi @zitrocy,

Generally the hashicorp/aws provider expects to manage the entirety of any object it’s been asked to manage, including all of its tags.

However, you can configure the provider to ignore tags with specific names or specific prefixes across all of the managed objects using an ignore_tags block in your provider configuration. That instructs the provider to effectively pretend that any matching tags don’t exist at all, thus allowing other systems outside of Terraform to manage those tags.

That setting is most often used to ignore tags that get created automatically as a side-effect of using other services that integrate with EC2. However, you could also use it to ignore Name tags if you are willing to make the rule that those are never set by Terraform, and always set elsewhere.

  ignore_tags {
    keys = ["Name"]
  }