[アップデート] EKS Capabilities (機能) を利用できるようになったので、AWS マネージドな Argo CD を試してみた

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 6.0.1"

  name = "eks-vpc"

  cidr = "10.0.0.0/16"

  azs             = ["ap-northeast-1a", "ap-northeast-1c", "ap-northeast-1d"]
  public_subnets  = ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.100.0/24", "10.0.101.0/24", "10.0.102.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = true
  public_subnet_tags = {
    "kubernetes.io/role/elb" = 1
  }

  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = 1
  }

}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 21.0.4"

  name               = local.cluster_name
  kubernetes_version = "1.34"

  addons = {
    coredns    = {}
    kube-proxy = {}
    vpc-cni = {
      before_compute = true
    }
    eks-pod-identity-agent = {}
  }

  endpoint_public_access  = true
  endpoint_private_access = true
  enable_irsa             = false

  authentication_mode = "API"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  enable_cluster_creator_admin_permissions = true

  eks_managed_node_groups = {
    default = {
      name = "default"

      ami_type       = "AL2023_x86_64_STANDARD"
      instance_types = ["t3.medium"]

      min_size     = 1
      max_size     = 3
      desired_size = 2

      metadata_options = {
        http_tokens                 = "required"
        http_put_response_hop_limit = 2
      }
    }
  }
}

apiVersion: v1
kind: Secret
metadata:
  name: test-cluster
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
stringData:
  name: test-cluster
  server: arn:aws:eks:ap-northeast-1:xxxxxxxxxxxx:cluster/test-cluster
  project: default

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    targetRevision: HEAD
    path: guestbook
  destination:
    name: test-cluster # 実際のクラスター名に修正
    namespace: guestbook
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

% kubectl get application -n argocd -o yaml
apiVersion: v1
items:
- apiVersion: argoproj.io/v1alpha1
  kind: Application
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"argoproj.io/v1alpha1","kind":"Application","metadata":{"annotations":{},"name":"guestbook","namespace":"argocd"},"spec":{"destination":{"name":"test-cluster","namespace":"guestbook"},"project":"default","source":{"path":"guestbook","repoURL":"https://github.com/argoproj/argocd-example-apps.git","targetRevision":"HEAD"},"syncPolicy":{"automated":{"prune":false,"selfHeal":true},"syncOptions":["CreateNamespace=true"]}}}
    creationTimestamp: "2025-12-01T18:44:10Z"
    generation: 6
    name: guestbook
    namespace: argocd
    resourceVersion: "208705"
    uid: f9597f98-643a-45dc-9326-b0357aed23c7
  spec:
    destination:
      name: test-cluster
      namespace: guestbook
    project: default
    source:
      path: guestbook
      repoURL: https://github.com/argoproj/argocd-example-apps.git
      targetRevision: HEAD
    syncPolicy:
      automated:
        prune: false
        selfHeal: true
      syncOptions:
      - CreateNamespace=true
  status:
    conditions:
    - lastTransitionTime: "2025-12-01T18:44:10Z"
      message: 'Failed to load live state: failed to get cluster info for "arn:aws:eks:ap-northeast-1:xxxxxxxxxxxx:cluster/test-cluster":
        error synchronizing cache state : failed to sync cluster https://6E1A1CE6FD98DF5F8BC0B1C65D97CC49.ap-northeast-1.prod.ccs.eks.aws.dev:
        failed to load initial state of resource ReplicationController: failed to
        list resources: replicationcontrollers is forbidden: User "arn:aws:sts::xxxxxxxxxxxx:assumed-role/AmazonEKSCapabilityArgoCDRole/aws-go-sdk-1764614651315276716"
        cannot list resource "replicationcontrollers" in API group "" at the cluster
        scope'
      type: ComparisonError
    - lastTransitionTime: "2025-12-01T18:44:10Z"
      message: 'Failed to load target state: failed to get cluster version for cluster
        "arn:aws:eks:ap-northeast-1:xxxxxxxxxxxx:cluster/test-cluster": failed to
        get cluster info for "arn:aws:eks:ap-northeast-1:xxxxxxxxxxxx:cluster/test-cluster":
        error synchronizing cache state : failed to sync cluster https://6E1A1CE6FD98DF5F8BC0B1C65D97CC49.ap-northeast-1.prod.ccs.eks.aws.dev:
        failed to load initial state of resource ReplicationController: failed to
        list resources: replicationcontrollers is forbidden: User "arn:aws:sts::xxxxxxxxxxxx:assumed-role/AmazonEKSCapabilityArgoCDRole/aws-go-sdk-1764614651315276716"
        cannot list resource "replicationcontrollers" in API group "" at the cluster
        scope'
      type: ComparisonError
    - lastTransitionTime: "2025-12-01T18:44:10Z"
      message: 'error synchronizing cache state : failed to sync cluster https://6E1A1CE6FD98DF5F8BC0B1C65D97CC49.ap-northeast-1.prod.ccs.eks.aws.dev:
        failed to load initial state of resource ReplicationController: failed to
        list resources: replicationcontrollers is forbidden: User "arn:aws:sts::xxxxxxxxxxxx:assumed-role/AmazonEKSCapabilityArgoCDRole/aws-go-sdk-1764614651315276716"
        cannot list resource "replicationcontrollers" in API group "" at the cluster
        scope'
      type: UnknownError
    controllerNamespace: 5453cae0-18f4-41f0-bc56-619a79902187-argocd-86cd6d99-7f56fa4e
    health:
      lastTransitionTime: "2025-12-01T18:44:12Z"
      status: Healthy
    reconciledAt: "2025-12-01T18:44:10Z"
    resourceHealthSource: appTree
    sync:
      comparedTo:
        destination:
          name: test-cluster
          namespace: guestbook
        source:
          path: guestbook
          repoURL: https://github.com/argoproj/argocd-example-apps.git
          targetRevision: HEAD
      status: Unknown
kind: List
metadata:
  resourceVersion: ""

level=warning msg="access denied" client="127.0.0.1:39580" error="sts getCallerIdentity failed: error from AWS (expected 200, got 403) on ap-northeast-1 endpoint. Body: {\"Error\":{\"Code\":\"InvalidClientTokenId\",\"Message\":\"The security token included in the request is invalid.\",\"Type\":\"Sender\"},\"RequestId\":\"005269ba-0975-4f0a-a209-e1e301f26b36\"}" method=POST path=/authenticate