feat: Issue 1193 support for tagging subnets by name

[voidshard]

Description

Allows one to add per-subnet tags, settable by subnet name.

Motivation and Context

Currently it is possible to set tags on all subnets, or all subnets of a given distinction (eg. public, private, ..) but it is not possible to set tags on a given subnet. This is the motivation behind this issue and the related MR. This MR adds the same support for each subnet type rather than just public & private.

Breaking Changes

None

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects

I added my own simple example. It includes cases where all, none and a subset of subnets have custom tags added by name.

[voidshard]

@antonbabenko @bryantbiggs please let me know your thoughts - we switched to using this module at work to define our VPCs but need a bit more flexibility to tag subnets appropriately for autodiscovery & configuration purposes.

[jpriebe]

This is a big problem for us. We tried to use aws_ec2_tag on the subnets outside of the module to add the kubernetes.io/role/internal-elb tags to the specific private subnets we want to use for internal load balancers, but then our terraform plans have perpetual noise as the terraform-aws-modules/vpc/aws module wants to delete the tags, and then on the next run, the aws_ec2_tag resource wants to restore the tags.

Is there at least a workaround for this problem (other than ignoring tags with the "kubernetes.io/role" prefix?

[voidshard]

@antonbabenko @bryantbiggs please can we have a review?

[bryantbiggs]

yes - unfortunately we are not going to accept this approach as we've stated several times before in other PRs

[voidshard]

yes - unfortunately we are not going to accept this approach as we've stated several times before in other PRs

That's fine, but in that case can we have an explanation & some kind of work around? Or what approach would you accept? I'm happy to work on something because like everyone who made those other PRs - I have the same problem. Work with us dude.

Right now we either run terraform & tag subnets by hand, or use aws-ec2-tag and have the two resources fight it out on each run.

[jpriebe]

I can't believe how resistant the maintainers have been to this concept. Not even just the implementations -- it seems like the very concept is anathema to them.

We have multiple sets of private subnets. Only one set should be tagged with EKS tags. But if we tag via terraform outsidde of this module, the module wants to remove them on the next apply, and then on the next apply after that, our terraform wants to restore them. I'm stuck with infinite noise and potential breakage of EKS.

Please provide a viable workaround, or at least tell us this feature is on your short-term roadmap.

[bryantbiggs]

I can't believe how resistant the maintainers have been to this concept. Not even just the implementations -- it seems like the very concept is anathema to them.

We have multiple sets of private subnets. Only one set should be tagged with EKS tags. But if we tag via terraform outsidde of this module, the module wants to remove them on the next apply, and then on the next apply after that, our terraform wants to restore them. I'm stuck with infinite noise and potential breakage of EKS.

Please provide a viable workaround, or at least tell us this feature is on your short-term roadmap.

Please provide funding, or at least have patience as we work through a number of significant changes

[voidshard]

If you want to ask for funding you first have to clearly communicate your plans and intentions -- no one provides funding into an unknown black box. Well, no one that isn't a government.