feat: grant a default set of admin roles cluster access on every cluster (#82)

* feat: grant a default set of admin roles cluster access on every cluster

Adds eks_default_admin_role_names (default admin-dply-terraform, comet-admin). The
roles are looked up by name in the cluster's account, so the ARN carries the role's
path (role/system/comet-admin) and a missing role fails at plan, not at
CreateAccessEntry. They are merged with eks_admin_role_arns into one ARN-keyed set, so
existing entries keep their keys and a principal listed in both gets one entry.

Wrappers get the baseline on the version bump; set the variable to [] or a shorter
list where a role doesn't exist (e.g. a cluster in another account).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: skip the default admin role lookup in CONFIG_MAP mode

CONFIG_MAP clusters have no access entries, so the defaults can't apply there and the
lookup would only add a way for the plan to fail.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: obezpalko

main.tf

@@ -274,6 +274,7 @@ module "comet_eks" {
   eks_authentication_mode                                 = var.eks_authentication_mode
   eks_enable_cluster_creator_admin_permissions            = var.eks_enable_cluster_creator_admin_permissions
   eks_admin_role_arns                                     = var.eks_admin_role_arns
+  eks_default_admin_role_names                            = var.eks_default_admin_role_names
   kms_key_administrators                                  = var.eks_kms_key_administrators
   kms_key_users                                           = var.eks_kms_key_users
   eks_mng_ami_type                                        = var.eks_mng_ami_type

modules/comet_eks/main.tf

@@ -159,9 +159,11 @@ locals {
     } : {}
   )
 
-  # Build access entries for admin roles
+  # Build access entries for admin roles: the fleet-wide defaults plus the caller's list,
+  # keyed by ARN so order doesn't matter and a principal listed twice gets one entry.
+  admin_role_arns = toset(concat([for r in data.aws_iam_role.default_admins : r.arn], var.eks_admin_role_arns))
   admin_access_entries = {
-    for arn in var.eks_admin_role_arns : arn => {
+    for arn in local.admin_role_arns : arn => {
       principal_arn = arn
       type          = "STANDARD"
       policy_associations = {
@@ -1075,6 +1077,13 @@ module "cloudwatch_exporter_irsa_role" {
 #### Karpenter Prerequisites ####
 #########################################
 
+# By name, so the ARN carries the role's path (comet-admin lives under /system/). Skipped in
+# CONFIG_MAP mode, which has no access entries.
+data "aws_iam_role" "default_admins" {
+  for_each = var.eks_authentication_mode == "CONFIG_MAP" ? toset([]) : toset(var.eks_default_admin_role_names)
+  name     = each.value
+}
+
 data "aws_caller_identity" "current" {}
 
 # Region consistency guard.

modules/comet_eks/variables.tf

@@ -81,6 +81,12 @@ variable "eks_admin_role_arns" {
   default     = []
 }
 
+variable "eks_default_admin_role_names" {
+  description = "IAM role names in the cluster's account granted AmazonEKSClusterAdminPolicy on every cluster, in addition to eks_admin_role_arns. Looked up at plan, so a missing role fails the plan; set [] (or a shorter list) to opt out. Ignored when eks_authentication_mode is CONFIG_MAP."
+  type        = list(string)
+  default     = ["admin-dply-terraform", "comet-admin"]
+}
+
 variable "kms_key_administrators" {
   description = "List of IAM ARNs (users/roles) that should have administrator access to the EKS KMS key. These principals can manage the key."
   type        = list(string)

variables.tf

@@ -440,6 +440,12 @@ variable "eks_admin_role_arns" {
   default     = []
 }
 
+variable "eks_default_admin_role_names" {
+  description = "IAM role names in the cluster's account granted AmazonEKSClusterAdminPolicy on every cluster, in addition to eks_admin_role_arns. Looked up at plan, so a missing role fails the plan; set [] (or a shorter list) to opt out. Ignored when eks_authentication_mode is CONFIG_MAP."
+  type        = list(string)
+  default     = ["admin-dply-terraform", "comet-admin"]
+}
+
 variable "eks_kms_key_administrators" {
   description = "List of IAM ARNs (users/roles) that should have administrator access to the EKS KMS key. These principals can manage the key (update, delete, etc.)."
   type        = list(string)