Review

iam_aws_vpc_cni.tf

@@ -1,5 +1,5 @@
 locals {
-  handle_aws_vpc_cni = var.handle_iam_resources && (var.handle_iam_aws_vpc_cni || length(var.vpc_cni_addon) > 0)
+  handle_aws_vpc_cni = var.handle_iam_resources && var.handle_iam_aws_vpc_cni
 }
 
 resource "aws_iam_role" "aws_vpc_cni" {

main.tf

@@ -30,7 +30,7 @@ locals {
         }
       }
     }
-  } : {}
+  } : null
   # The Quortex cluster OIDC issuer.
   cluster_oidc_issuer = trimprefix(aws_eks_cluster.quortex.identity[0].oidc[0].issuer, "https://")
   node_group_labels = [
@@ -204,15 +204,15 @@ locals {
 }
 
 resource "aws_eks_addon" "vpc_cni_addon" {
-  count = local.handle_aws_vpc_cni ? 1 : 0
+  count = length(var.vpc_cni_addon) > 0 ? 1 : 0
 
   cluster_name                = aws_eks_cluster.quortex.name
   addon_name                  = "vpc-cni"
   addon_version               = var.vpc_cni_addon.version
   configuration_values        = jsonencode(merge(local.vpc_cni_configuration_values, var.vpc_cni_addon.configuration_values))
-  preserve                    = try(var.vpc_cni_addon.preserve, null)
-  resolve_conflicts_on_update = try(var.vpc_cni_addon.resolve_conflicts, "OVERWRITE")
-  resolve_conflicts_on_create = try(var.vpc_cni_addon.resolve_conflicts, "OVERWRITE")
+  preserve                    = var.vpc_cni_addon.preserve
+  resolve_conflicts_on_update = var.vpc_cni_addon.resolve_conflicts
+  resolve_conflicts_on_create = var.vpc_cni_addon.resolve_conflicts
   service_account_role_arn    = lookup(local.addon_irsa_service_account_arn, "vpc-cni", null)
 
   tags = var.tags

variables.tf

@@ -302,8 +302,13 @@ variable "cluster_addons" {
 
 variable "vpc_cni_addon" {
   description = "vpc-cni addon definition"
-  type        = any
-  default     = {}
+  type = object({
+    version              = string
+    resolve_conflicts    = optional(string, "OVERWRITE")
+    preserve             = optional(bool)
+    configuration_values = any
+  })
+  nullable = true
 }
 
 variable "manage_aws_auth_configmap" {