feat: add EKS Capabilities support (Argo CD, ACK, KRO)

- Add `capabilities` map variable for independently-enableable managed
  platform features
- Create capabilities.tf with aws_eks_capability resources and
  auto-created IAM roles per capability
- Add capabilities and capability_role_arns outputs
- Bump AWS provider to >= 6.25.0 for aws_eks_capability resource
- Support ARGOCD configuration (IDC, RBAC, network access)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Benbentwo

.terraform.lock.hcl

@@ -0,0 +1,119 @@
+# EKS Capabilities: Argo CD, ACK, KRO
+# https://docs.aws.amazon.com/eks/latest/userguide/capabilities.html
+
+locals {
+  enabled_capabilities = {
+    for k, v in var.capabilities : k => v if local.enabled && v.enabled
+  }
+
+  # Capabilities that need auto-created IAM roles
+  capabilities_needing_roles = {
+    for k, v in local.enabled_capabilities : k => v if v.role_arn == null
+  }
+
+  # Final role ARN map: auto-created or user-provided
+  capability_role_arns = {
+    for k, v in local.enabled_capabilities : k => coalesce(
+      v.role_arn,
+      try(aws_iam_role.capability[k].arn, null)
+    )
+  }
+}
+
+# IAM roles for capabilities that don't provide their own
+module "capability_label" {
+  for_each = local.capabilities_needing_roles
+
+  source  = "cloudposse/label/null"
+  version = "0.25.0"
+
+  attributes = ["capability", each.key]
+  context    = module.this.context
+}
+
+data "aws_iam_policy_document" "capability_assume_role" {
+  count = length(local.capabilities_needing_roles) > 0 ? 1 : 0
+
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole", "sts:TagSession"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["capabilities.eks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "capability" {
+  for_each = local.capabilities_needing_roles
+
+  name                 = module.capability_label[each.key].id
+  assume_role_policy   = one(data.aws_iam_policy_document.capability_assume_role[*].json)
+  tags                 = module.capability_label[each.key].tags
+  permissions_boundary = var.permissions_boundary
+}
+
+resource "aws_eks_capability" "default" {
+  for_each = local.enabled_capabilities
+
+  cluster_name              = local.eks_cluster_id
+  capability_name           = each.key
+  type                      = each.value.type
+  role_arn                  = local.capability_role_arns[each.key]
+  delete_propagation_policy = each.value.delete_propagation_policy
+  tags                      = module.label.tags
+
+  dynamic "configuration" {
+    for_each = each.value.configuration != null && each.value.type == "ARGOCD" ? [each.value.configuration] : []
+    content {
+      dynamic "argo_cd" {
+        for_each = configuration.value.argo_cd != null ? [configuration.value.argo_cd] : []
+        content {
+          namespace = argo_cd.value.namespace
+
+          dynamic "aws_idc" {
+            for_each = argo_cd.value.aws_idc != null ? [argo_cd.value.aws_idc] : []
+            content {
+              idc_instance_arn = aws_idc.value.idc_instance_arn
+              idc_region       = aws_idc.value.idc_region
+            }
+          }
+
+          dynamic "network_access" {
+            for_each = argo_cd.value.network_access != null ? [argo_cd.value.network_access] : []
+            content {
+              vpce_ids = network_access.value.vpce_ids
+            }
+          }
+
+          dynamic "rbac_role_mapping" {
+            for_each = argo_cd.value.rbac_role_mapping
+            content {
+              role = rbac_role_mapping.value.role
+
+              dynamic "identity" {
+                for_each = rbac_role_mapping.value.identity
+                content {
+                  id   = identity.value.id
+                  type = identity.value.type
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  timeouts {
+    create = each.value.create_timeout
+    update = each.value.update_timeout
+    delete = each.value.delete_timeout
+  }
+
+  depends_on = [
+    aws_eks_cluster.default,
+    aws_iam_role.capability,
+  ]
+}

capabilities.tf

@@ -75,6 +75,24 @@ output "auto_mode_enabled" {
   value       = local.auto_mode_all_enabled
 }
 
+output "capabilities" {
+  description = "Map of enabled EKS Capabilities with their ARNs and types"
+  value = {
+    for k, v in aws_eks_capability.default : k => {
+      arn     = v.arn
+      type    = v.type
+      version = v.version
+    }
+  }
+}
+
+output "capability_role_arns" {
+  description = "Map of auto-created capability IAM role ARNs"
+  value = {
+    for k, v in aws_iam_role.capability : k => v.arn
+  }
+}
+
 output "cluster_encryption_config_enabled" {
   description = "If true, Cluster Encryption Configuration is enabled"
   value       = var.cluster_encryption_config_enabled

outputs.tf

@@ -246,6 +246,64 @@ variable "auto_mode_elastic_load_balancing" {
   nullable = false
 }
 
+variable "capabilities" {
+  description = <<-EOT
+    Map of EKS Capabilities to enable on the cluster. Each key is the capability
+    name (must be unique within the cluster). Supported types: ACK, ARGOCD, KRO.
+
+    When `role_arn` is null, an IAM role with a trust policy for
+    `capabilities.eks.amazonaws.com` is automatically created.
+
+    The `configuration` block is only applicable to ARGOCD capabilities.
+    ACK and KRO do not currently support configuration.
+  EOT
+  type = map(object({
+    enabled                   = optional(bool, true)
+    type                      = string # ACK, ARGOCD, KRO
+    role_arn                  = optional(string, null)
+    delete_propagation_policy = optional(string, "RETAIN")
+    configuration = optional(object({
+      argo_cd = optional(object({
+        namespace = optional(string, "argocd")
+        aws_idc = optional(object({
+          idc_instance_arn = string
+          idc_region       = optional(string, null)
+        }), null)
+        network_access = optional(object({
+          vpce_ids = optional(list(string), [])
+        }), null)
+        rbac_role_mapping = optional(list(object({
+          role = string # ADMIN, EDITOR, VIEWER
+          identity = list(object({
+            id   = string
+            type = string # SSO_USER, SSO_GROUP
+          }))
+        })), [])
+      }), null)
+    }), null)
+    create_timeout = optional(string, null)
+    update_timeout = optional(string, null)
+    delete_timeout = optional(string, null)
+  }))
+  default  = {}
+  nullable = false
+
+  validation {
+    condition = alltrue([
+      for k, v in var.capabilities : contains(["ACK", "ARGOCD", "KRO"], v.type)
+    ])
+    error_message = "Each capability type must be one of: ACK, ARGOCD, KRO."
+  }
+
+  validation {
+    condition = alltrue([
+      for k, v in var.capabilities :
+      v.configuration == null || v.type == "ARGOCD"
+    ])
+    error_message = "The configuration block is only supported for ARGOCD capabilities."
+  }
+}
+
 variable "upgrade_policy" {
   type = object({
     support_type = optional(string, null)

variables.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.79.0"
+      version = ">= 6.25.0"
     }
     tls = {
       source  = "hashicorp/tls"