From 5822fc7619d554eb28367a310f0dcaf01e8525ca Mon Sep 17 00:00:00 2001 From: David Fernandez Date: Thu, 16 Jul 2026 15:02:21 -0300 Subject: [PATCH 1/2] feat(base): pass cloudwatch service account annotations for IRSA support Add cloudwatch_service_account_annotations (map(string)) rendered into the base chart's cloudwatch.serviceAccount.annotations only when cloudwatch is enabled and the map is non-empty, so the logs controller ServiceAccount can carry an eks.amazonaws.com/role-arn and reach CloudWatch via IRSA instead of the node instance role. Co-Authored-By: Claude Opus 4.8 (1M context) --- nullplatform/base/README.md | 6 ++++++ nullplatform/base/locals.tf | 11 ++++++----- .../base/templates/nullplatform_base_values.tmpl.yaml | 7 +++++++ nullplatform/base/variables.tf | 6 ++++++ 4 files changed, 25 insertions(+), 5 deletions(-) diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 1e934e2c..2193de3a 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -126,6 +126,7 @@ resource "example_resource" "this" { | [cloudwatch\_enabled](#input\_cloudwatch\_enabled) | Enable CloudWatch (global switch). | `bool` | `false` | no | | [cloudwatch\_logs\_enabled](#input\_cloudwatch\_logs\_enabled) | Enable log forwarding to CloudWatch. | `bool` | `false` | no | | [cloudwatch\_performance\_metrics\_enabled](#input\_cloudwatch\_performance\_metrics\_enabled) | Enable performance metrics in CloudWatch. | `bool` | `false` | no | +| [cloudwatch\_service\_account\_annotations](#input\_cloudwatch\_service\_account\_annotations) | Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch\_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role. | `map(string)` | `{}` | no | | [control\_plane\_enabled](#input\_control\_plane\_enabled) | Enable the control plane. | `bool` | `false` | no | | [datadog\_api\_key](#input\_datadog\_api\_key) | Datadog API key. | `string` | `""` | no | | [datadog\_enabled](#input\_datadog\_enabled) | Enable Datadog integration. | `bool` | `false` | no | @@ -482,6 +483,11 @@ resource "example_resource" "this" { "description": "Enable access logs in CloudWatch.", "required": false }, + { + "name": "cloudwatch_service_account_annotations", + "description": "Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role.", + "required": false + }, { "name": "metrics_server_enabled", "description": "Enable the metrics server.", diff --git a/nullplatform/base/locals.tf b/nullplatform/base/locals.tf index 1c1715d3..74ccbf7f 100644 --- a/nullplatform/base/locals.tf +++ b/nullplatform/base/locals.tf @@ -98,11 +98,12 @@ locals { newrelic_region = var.newrelic_region # ---- cloudwatch ---- - cloudwatch_enabled = var.cloudwatch_enabled ? "true" : "false" - cloudwatch_logs_enabled = var.cloudwatch_logs_enabled ? "true" : "false" - cloudwatch_performancemetrics_enabled = var.cloudwatch_performance_metrics_enabled ? "true" : "false" - cloudwatch_custommetrics_enabled = var.cloudwatch_custom_metrics_enabled ? "true" : "false" - cloudwatch_accesslogs_enabled = var.cloudwatch_access_logs_enabled ? "true" : "false" + cloudwatch_enabled = var.cloudwatch_enabled ? "true" : "false" + cloudwatch_logs_enabled = var.cloudwatch_logs_enabled ? "true" : "false" + cloudwatch_performancemetrics_enabled = var.cloudwatch_performance_metrics_enabled ? "true" : "false" + cloudwatch_custommetrics_enabled = var.cloudwatch_custom_metrics_enabled ? "true" : "false" + cloudwatch_accesslogs_enabled = var.cloudwatch_access_logs_enabled ? "true" : "false" + cloudwatch_service_account_annotations = var.cloudwatch_service_account_annotations # ---- metrics server ---- metricsserver_enabled = var.metrics_server_enabled ? "true" : "false" diff --git a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml index a2d7aeb4..45e8a37c 100644 --- a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml +++ b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml @@ -150,6 +150,13 @@ cloudwatch: enabled: ${cloudwatch_custommetrics_enabled} accessLogs: enabled: ${cloudwatch_accesslogs_enabled} +%{ if length(cloudwatch_service_account_annotations) > 0 ~} + serviceAccount: + annotations: +%{ for key, value in cloudwatch_service_account_annotations ~} + ${key}: "${value}" +%{ endfor ~} +%{ endif ~} # Metrics server configuration metricsServer: enabled: ${metricsserver_enabled} diff --git a/nullplatform/base/variables.tf b/nullplatform/base/variables.tf index 746f6e1a..99293276 100644 --- a/nullplatform/base/variables.tf +++ b/nullplatform/base/variables.tf @@ -365,6 +365,12 @@ variable "cloudwatch_access_logs_enabled" { default = false } +variable "cloudwatch_service_account_annotations" { + type = map(string) + description = "Annotations for the logs controller ServiceAccount (nullplatform-pod-metadata-reader-sa). Rendered only when cloudwatch_enabled is true. Set eks.amazonaws.com/role-arn here to use IRSA instead of the node instance role." + default = {} +} + ############################################ # Metrics Server ############################################ From bd2de502aa575c34035ce236295f5a6907b64c41 Mon Sep 17 00:00:00 2001 From: David Fernandez Date: Thu, 16 Jul 2026 16:15:04 -0300 Subject: [PATCH 2/2] fix(base): gate cloudwatch SA annotations on cloudwatch_enabled Only render cloudwatch.serviceAccount.annotations when cloudwatch is enabled, matching the base chart's own gate and the module's intent. Addresses review feedback on #441. Co-Authored-By: Claude Opus 4.8 (1M context) --- nullplatform/base/templates/nullplatform_base_values.tmpl.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml index 45e8a37c..310f768e 100644 --- a/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml +++ b/nullplatform/base/templates/nullplatform_base_values.tmpl.yaml @@ -150,7 +150,7 @@ cloudwatch: enabled: ${cloudwatch_custommetrics_enabled} accessLogs: enabled: ${cloudwatch_accesslogs_enabled} -%{ if length(cloudwatch_service_account_annotations) > 0 ~} +%{ if cloudwatch_enabled == "true" && length(cloudwatch_service_account_annotations) > 0 ~} serviceAccount: annotations: %{ for key, value in cloudwatch_service_account_annotations ~}