Terraform on DevOps & Rock'N'Roll

Terragrunt: deleting the boilerplate you were told to write

Tue, 19 May 2026 00:08:30 +0000

Terragrunt exists to keep you DRY, and then you open a mature Terragrunt repository and find ninety terragrunt.hcl files that are eighty percent identical. There’s a joke in there somewhere.

It isn’t Terragrunt’s fault. The default onboarding path — copy the folder next door, change the inputs — is the fastest way to a working stack and the slowest way to a maintainable one. Here’s what I strip out when I inherit one of these.

EKS Access Entries: one ARN, one cluster, no sharing

Tue, 21 Apr 2026 00:08:30 +0000

EKS Access Entries replaced the aws-auth ConfigMap and made cluster authorization a proper AWS API object instead of a YAML blob that you edited with trembling hands, hoping you wouldn’t lock yourself out. It’s a genuine improvement. But moving auth into the API surface also moves it into Terraform state, and that’s where it gets interesting.

The error that sent me down this road:

Error: creating EKS Access Entry (test-spain-001:arn:aws:iam::123456789012:role/PlatformAdmin):
ResourceInUseException: The specified access entry resource is already in use
on this cluster.

My first reaction was the wrong one: are access entries global? Did creating one for cluster A break cluster B?

Fargate profiles and the art of waiting your turn

Tue, 07 Apr 2026 00:08:30 +0000

There is a special kind of Terraform error that only shows up when you destroy things. Your apply has been green for months, everyone is happy, and then one day you run a terragrunt destroy on a test cluster and get this:

Error: deleting EKS Fargate Profile (test-spain-001:test-spain-001-karpenter-2a):
operation error EKS: DeleteFargateProfile, https response error StatusCode: 409,
ResourceInUseException: Cannot delete Fargate profile
test-spain-001-karpenter-2a because cluster test-spain-001 currently has
Fargate profile test-spain-001-karpenter-2b in status DELETING

Run it again — it works. Run it on the next cluster — it fails again. Welcome to the club.