[StevenPG]

Part of #1782.

Changes

Enable EKS node auto repair on the managed node group (node_repair_config), controlled by a new aws_enable_node_auto_repair variable that defaults to true, matching GKE's default behavior. Unhealthy nodes (for example stuck in NotReady) are drained and replaced automatically. Applying this to an existing cluster updates the node group in place and does not replace nodes. Set aws_enable_node_auto_repair = false to keep the previous behavior.

Testing

• terraform fmt -recursive -check deploy
• terraform validate on terraform-aws-dss
• generate_terraform_variables.sh --lint

Applied to a live cluster

Applied to an existing EKS 1.34 deployment (3 nodes, CockroachDB, us-west-1) that was created with an older version of this module. The same apply also changed aws_instance_type, so the node group was replaced rather than updated in place.

• The node group with node_repair_config enabled was created successfully, and the old group was drained and deleted. With CockroachDB set to hard pod anti-affinity through a Helm override, the pods moved one at a time and CockroachDB kept 3 live nodes and 0 unavailable ranges.
• aws eks describe-nodegroup reports nodeRepairConfig.enabled: true.
• A follow-up terraform plan shows no changes.

[barroco]

Thank you very much @StevenPG . May I kindly ask you to split the PR so it can be reviewed and merged indenpendently ?
If you wish to keep a logical grouping between them to share the context, feel free to open an issue and reference it the PRs descriptions.

[barroco]

I think we should limit auto repair to one node at a time with max_parallel_nodes_repaired_count = 1, so that a majority of the datastore nodes stays available during repairs.
This requires AWS provider 6.20.0 or later.

[StevenPG]

Added this is commit: 5da6637

I tried to keep the configuration open such that the two options are 1 or null, that way the onus isn't on the deployer to make a determination on the ideal value, but users who need the prior no-repair implementation can opt-out.

[barroco]

Can you please provide a reference to check GKE feature parity ?

[StevenPG]

My understanding is that for the google terraform provider, if a section is not provided, the default values are used.

I looked through the GKE documentation and I believe I understood it well enough to make that claim, but let me know if I'm off base!

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#auto_repair-1

[auto_repair](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#auto_repair-1) - (Optional) Whether the nodes will be automatically repaired. Enabled by default.

The GKE configuration doesn't include a management block:

dss/deploy/infrastructure/dependencies/terraform-google-kubernetes/cluster.tf

Lines 21 to 44 in a4cccdd

	resource "google_container_node_pool" "dss_pool" {
	name = "dss-pool"
	location = var.google_zone
	cluster = google_container_cluster.kubernetes_cluster.name
	node_count = var.node_count
	node_config {
	machine_type = var.google_machine_type
	disk_size_gb = 25 # Kubernetes PVC will create distinct disks.
	# TODO: Use non-default service account with IAM roles
	oauth_scopes = [
	"https://www.googleapis.com/auth/cloud-platform"
	]
	metadata = {
	"disable-legacy-endpoints" = true
	}
	}
	lifecycle {
	create_before_destroy = true
	}
	}