Context
The EKS development environment was defined in CloudFormation, while the rest of the platform's tooling and modules had standardised on Terraform.
The problem
Two IaC tools on one platform means two mental models, two review paths, and modules that cannot be shared. Migrating is straightforward on paper and risky in practice: the environment is in use, and a mistake during import is indistinguishable from an outage.
- step: Changepull request
- control: OIDCshort-lived role
- step: terraform planposted on the PR
- control: Reviewhuman approval
- result: applyEKS, private IPv6
Approach
- 01
Rebuild as explicit Terraform resources
The cluster was re-expressed as 50+ Terraform-managed resources rather than wrapped or partially imported, so the state matches what the code says.
- 02
Move networking to private IPv6 subnets
The migration was the moment to change the network topology, since the addressing was being redefined anyway.
- 03
Authenticate CI with OIDC, not keys
Pipelines assume a role through OIDC rather than holding long-lived AWS credentials, so there is nothing static to leak or rotate.
- 04
Route every change through plan-on-PR
Terraform plans run on pull requests, so the effect of a change is reviewable before it is applied. This is what made the migration safe to do incrementally.