feat(eks): pin the cluster addon versions with addon_versions

infrastructure/aws/eks/main.tf

@@ -45,17 +45,28 @@ module "eks" {
     }
   } : {}
 
+  # An addon left out of var.addon_versions keeps the upstream default
+  # (most_recent = true), which re-reads the newest version available in EKS on
+  # every plan and shows drift whenever AWS publishes a build. Pinning it here
+  # wins over that lookup.
   addons = {
     aws-ebs-csi-driver = {
       service_account_role_arn = aws_iam_role.ebs_csi_driver.arn
+      addon_version            = lookup(var.addon_versions, "aws-ebs-csi-driver", null)
+    }
+    coredns = {
+      addon_version = lookup(var.addon_versions, "coredns", null)
     }
-    coredns = {}
     eks-pod-identity-agent = {
       before_compute = true
+      addon_version  = lookup(var.addon_versions, "eks-pod-identity-agent", null)
+    }
+    kube-proxy = {
+      addon_version = lookup(var.addon_versions, "kube-proxy", null)
     }
-    kube-proxy = {}
     vpc-cni = {
       before_compute = true
+      addon_version  = lookup(var.addon_versions, "vpc-cni", null)
     }
   }
 

infrastructure/aws/eks/variables.tf

@@ -237,3 +237,31 @@ variable "aws_profile" {
   type        = string
   default     = ""
 }
+
+# Pinned versions for the cluster addons this module installs. The version
+# pinning policy (see VERSIONS.md) asks for every chart, image and ref to be
+# explicit; addons were the one thing still resolved as "whatever is newest",
+# so each release published by AWS showed up as drift in an unrelated plan.
+#
+#   addon_versions = {
+#     vpc-cni    = "v1.23.1-eksbuild.1"
+#     kube-proxy = "v1.34.6-eksbuild.25"
+#   }
+#
+# Read the current values with:
+#   aws eks describe-addon --cluster-name <cluster> --addon-name vpc-cni \
+#     --query addon.addonVersion --output text
+variable "addon_versions" {
+  description = "Pinned EKS addon versions, keyed by addon name (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni). An addon left out keeps resolving to the most recent version, which surfaces as plan drift whenever AWS publishes a new build."
+  type        = map(string)
+  default     = {}
+  nullable    = false
+
+  validation {
+    condition = alltrue([
+      for name in keys(var.addon_versions) :
+      contains(["aws-ebs-csi-driver", "coredns", "eks-pod-identity-agent", "kube-proxy", "vpc-cni"], name)
+    ])
+    error_message = "addon_versions only accepts the addons this module installs: aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni."
+  }
+}