feat: Add variable cluster_primary_security_group_tags for cluster primary security group tags

README.md

@@ -308,6 +308,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
 | <a name="input_cluster_identity_providers"></a> [cluster\_identity\_providers](#input\_cluster\_identity\_providers) | Map of cluster identity provider configurations to enable for the cluster. Note - this is different/separate from IRSA | `any` | `{}` | no |
 | <a name="input_cluster_ip_family"></a> [cluster\_ip\_family](#input\_cluster\_ip\_family) | The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6`. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created | `string` | `null` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | `""` | no |
+| <a name="input_cluster_primary_security_group_tags"></a> [cluster\_primary\_security\_group\_tags](#input\_cluster\_primary\_security\_group\_tags) | A map of additional tags to add to the cluster primary security group. This security group is created by the EKS service, not the module, and therefore tagging is handled after cluster creation | `map(string)` | `{}` | no |
 | <a name="input_cluster_security_group_additional_rules"></a> [cluster\_security\_group\_additional\_rules](#input\_cluster\_security\_group\_additional\_rules) | List of additional security group rules to add to the cluster security group created. Set `source_node_security_group = true` inside rules to set the `node_security_group` as source | `any` | `{}` | no |
 | <a name="input_cluster_security_group_description"></a> [cluster\_security\_group\_description](#input\_cluster\_security\_group\_description) | Description of the cluster security group created | `string` | `"EKS cluster security group"` | no |
 | <a name="input_cluster_security_group_id"></a> [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | Existing security group ID to be attached to the cluster | `string` | `""` | no |

main.tf

@@ -94,7 +94,7 @@ resource "aws_ec2_tag" "cluster_primary_security_group" {
   # This should not affect the name of the cluster primary security group
   # Ref: https://github.com/terraform-aws-modules/terraform-aws-eks/pull/2006
   # Ref: https://github.com/terraform-aws-modules/terraform-aws-eks/pull/2008
-  for_each = { for k, v in merge(var.tags, var.cluster_tags) :
+  for_each = { for k, v in merge(var.tags, var.cluster_tags, var.cluster_primary_security_group_tags) :
     k => v if local.create && k != "Name" && var.create_cluster_primary_security_group_tags && v != null
   }
 

variables.tf

@@ -118,6 +118,12 @@ variable "cluster_tags" {
   default     = {}
 }
 
+variable "cluster_primary_security_group_tags" {
+  description = "A map of additional tags to add to the cluster primary security group. This security group is created by the EKS service, not the module, and therefore tagging is handled after cluster creation"
+  type        = map(string)
+  default     = {}
+}
+
 variable "create_cluster_primary_security_group_tags" {
   description = "Indicates whether or not to tag the cluster's primary security group. This security group is created by the EKS service, not the module, and therefore tagging is handled after cluster creation"
   type        = bool