fix: lookup-safe access for optional cluster_addons + additional_node_policies (RULE-015)#350
Merged
Merged
Conversation
…_policies (RULE-015)
Optional spec fields must be read via lookup(var.instance.spec, "field",
default) rather than var.instance.spec.field directly. The Facets exec path
does not reliably apply the optional() defaults declared in variables.tf, so a
blueprint that omits an optional field crashes at plan/apply on the direct
attribute access (RULE-015).
Two crash sites fixed:
1. kubernetes_cluster/eks_standard/1.0/main.tf — cluster_addons is optional
(only cluster_version is required). The locals read
var.instance.spec.cluster_addons and nested .vpc_cni / .kube_proxy /
.coredns directly, so a blueprint omitting cluster_addons crashed. Added a
cluster_addons_spec = lookup(var.instance.spec, "cluster_addons", {}) local
and routed every addon read through nested lookups with defaults. Omitting
cluster_addons now enables all default addons (matching the schema/UI
defaults).
2. karpenter/default/1.0/main.tf — additional_node_policies is optional but was
read directly via values(var.instance.spec.additional_node_policies),
crashing when omitted. Now values(lookup(var.instance.spec,
"additional_node_policies", {})).
Backward-compatible bugfix: behaviour is identical when the fields are present,
and previously-crashing omissions now fall back to documented defaults. No
version bump (RULE-023 reserves bumps for breaking changes).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
unni-facets
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug class (RULE-015)
Optional spec fields must be read via
lookup(var.instance.spec, "field", default), nevervar.instance.spec.fielddirectly. The Facets exec path does not reliably apply theoptional()defaults declared invariables.tf, so a blueprint that omits an optional field crashes at plan/apply on the direct attribute access.The two crash sites
1.
kubernetes_cluster/eks_standard/1.0/main.tfcluster_addonsis an optional spec field (onlycluster_versionis required). The locals read the outer mapvar.instance.spec.cluster_addonsand the nested.vpc_cni/.kube_proxy/.corednskeys directly. A blueprint that omitscluster_addonscrashes with an "attribute does not exist" error before any addon logic runs.Fix: introduce a safe local
and route every addon read through nested
lookup(local.cluster_addons_spec, "<key>", {}). With the field omitted, the per-addonenabled/versiondefaults apply, so all default addons are enabled (matching the schema/UI defaults).2.
karpenter/default/1.0/main.tfadditional_node_policiesis optional but was read viavalues(var.instance.spec.additional_node_policies), which crashes when the field is omitted.Fix:
Why it's non-breaking
Behaviour is identical when the fields are present; previously-crashing omissions now fall back to documented defaults. No version bump — RULE-023 reserves version bumps for breaking changes.
Note
The same lookup-safety fix is already carried in the flavored forks of these modules; this PR backports the fix to the shared upstream flavors.
🤖 Generated with Claude Code