--- title: Phase 9: Automated EKS Add-ons with Helm, OIDC, and IRSA... description: A practical walkthrough of automating EKS add-on management (AWS Load Balancer Controller and Metrics Server) using Terraform, Helm, OIDC, and IRSA —... canonical: https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Phase 9: Automated EKS Add-ons with Helm, OIDC, and IRSA in Terraform | daily.dev og:description: A practical walkthrough of automating EKS add-on management (AWS Load Balancer Controller and Metrics Server) using Terraform, Helm, OIDC, and IRSA —... og:url: https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6 og:image: https://api.daily.dev/og/posts/IurvrS7G6.png og:image:alt: Phase 9: Automated EKS Add-ons with Helm, OIDC, and IRSA in Terraform og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Phase 9: Automated EKS Add-ons with Helm, OIDC, and IRSA in Terraform **[Medium](https://daily.dev/sources/medium_js)** · 4 min read · 0 upvotes · 0 comments ## Summary A practical walkthrough of automating EKS add-on management (AWS Load Balancer Controller and Metrics Server) using Terraform, Helm, OIDC, and IRSA — eliminating manual CLI steps. Covers six common pitfalls: IAM policy JSON whitespace drift fixed with jsonencode/jsondecode normalization, http provider v2→v3 breaking attribute rename, replacing eksctl OIDC setup with native Terraform TLS certificate and OpenID Connect provider resources, dynamic Helm/Kubernetes provider auth via aws_eks_cluster_auth (no local kubeconfig needed), duplicate helm_release resource errors from multiple .tf files, and cross-module output wiring for policy/role ARNs. The end result is a fully declarative terraform apply that provisions VPC, EKS cluster, OIDC, IRSA, and both add-ons in one shot. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I fix the hashicorp/http Terraform provider breaking after upgrading from v2 to v3? In hashicorp/http provider v2.x, the response body was exposed as the `body` attribute; starting with v3.0.0, this was renamed to `response_body`, so any configuration referencing `data.http.*.body` breaks after upgrading and must be updated to reference `response_body` instead. _Terraform users tracking provider upgrades can watch for breaking attribute renames like this via daily.dev._ ### Why does my Terraform plan keep showing drift when fetching a remote IAM policy JSON with the http data source? Fetching a remote IAM policy document (such as the AWS ALB Controller policy JSON from GitHub) via a Terraform `data.http` source can cause continuous plan drift because of indentation or line-break differences in the raw string. The fix is to normalize it by wrapping the value in `jsonencode(jsondecode(data.http..response_body))` before assigning it to the IAM policy resource. _Terraform practitioners debugging IAM policy drift can find fixes like this via daily.dev._ ### How do I set up IAM Roles for Service Accounts (IRSA) for the AWS Load Balancer Controller without using eksctl? Declare the TLS certificate, OpenID Connect provider, and IAM assume-role policy directly in Terraform instead of running `eksctl utils associate-iam-oidc-provider`, which creates resources outside Terraform state. Use a `tls_certificate` data source pointed at the EKS cluster's OIDC issuer, an `aws_iam_openid_connect_provider` resource, and an `aws_iam_role` with an assume-role policy scoped to `system:serviceaccount:kube-system:aws-load-balancer-controller` via `sts:AssumeRoleWithWebIdentity`. _Teams keeping IRSA setups fully in Terraform state can track patterns like this via daily.dev._ ## Similar posts on daily.dev - [A weekend of GitOps: GitHub Actions, FluxCD, and Istio on EKS](https://daily.dev/posts/a-weekend-of-gitops-github-actions-fluxcd-and-istio-on-eks-p3dhqenln) · Medium · 6 upvotes · 0 comments - [Building a Production Style Kubernetes Platform on AWS with Amazon EKS](https://daily.dev/posts/building-a-production-style-kubernetes-platform-on-aws-with-amazon-eks-dh3yqcvc2) · Medium · 3 upvotes · 0 comments - [Getting Started with EKS — GitOps with Flux, Helm, and Karpenter](https://daily.dev/posts/getting-started-with-eks-gitops-with-flux-helm-and-karpenter-pnppl8ccw) · AWS Fundamentals · 8 upvotes · 0 comments - [Amazon EKS simplifies providing IAM permissions to EKS add-ons in AWS GovCloud \(US\) Regions](https://daily.dev/posts/amazon-eks-simplifies-providing-iam-permissions-to-eks-add-ons-in-aws-govcloud-us-regions-cos39kujm) · AWS · 0 upvotes · 0 comments - [Mitigating IAM Template Injection in AWS EKS](https://daily.dev/posts/mitigating-iam-template-injection-in-aws-eks-y1hca3b4h) · SitePoint · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#authentication](https://daily.dev/tags/authentication), [#terraform](https://daily.dev/tags/terraform), [#helm](https://daily.dev/tags/helm) [View this post on daily.dev](https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Phase 9: Automated EKS Add-ons with Helm, OIDC, and IRSA in Terraform","url":"https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6"},"datePublished":"2026-07-27T19:34:46.403Z","dateModified":"2026-09-14T06:52:56.035Z","description":"A practical walkthrough of automating EKS add-on management (AWS Load Balancer Controller and Metrics Server) using Terraform, Helm, OIDC, and IRSA —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/595ccb02d7ed8fa3ecf35dee173e2478?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/595ccb02d7ed8fa3ecf35dee173e2478?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,authentication,terraform,helm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Phase 9: Automated EKS Add-ons with Helm, OIDC, and IRSA in Terraform"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/phase-9-automated-eks-add-ons-with-helm-oidc-and-irsa-in-terraform-iurvrs7g6#faq","mainEntity":[{"@type":"Question","name":"How do I fix the hashicorp/http Terraform provider breaking after upgrading from v2 to v3?","acceptedAnswer":{"@type":"Answer","text":"In hashicorp/http provider v2.x, the response body was exposed as the `body` attribute; starting with v3.0.0, this was renamed to `response_body`, so any configuration referencing `data.http.*.body` breaks after upgrading and must be updated to reference `response_body` instead. Terraform users tracking provider upgrades can watch for breaking attribute renames like this via daily.dev."}},{"@type":"Question","name":"Why does my Terraform plan keep showing drift when fetching a remote IAM policy JSON with the http data source?","acceptedAnswer":{"@type":"Answer","text":"Fetching a remote IAM policy document (such as the AWS ALB Controller policy JSON from GitHub) via a Terraform `data.http` source can cause continuous plan drift because of indentation or line-break differences in the raw string. The fix is to normalize it by wrapping the value in `jsonencode(jsondecode(data.http..response_body))` before assigning it to the IAM policy resource. Terraform practitioners debugging IAM policy drift can find fixes like this via daily.dev."}},{"@type":"Question","name":"How do I set up IAM Roles for Service Accounts (IRSA) for the AWS Load Balancer Controller without using eksctl?","acceptedAnswer":{"@type":"Answer","text":"Declare the TLS certificate, OpenID Connect provider, and IAM assume-role policy directly in Terraform instead of running `eksctl utils associate-iam-oidc-provider`, which creates resources outside Terraform state. Use a `tls_certificate` data source pointed at the EKS cluster's OIDC issuer, an `aws_iam_openid_connect_provider` resource, and an `aws_iam_role` with an assume-role policy scoped to `system:serviceaccount:kube-system:aws-load-balancer-controller` via `sts:AssumeRoleWithWebIdentity`. Teams keeping IRSA setups fully in Terraform state can track patterns like this via daily.dev."}}]} ```