Hello folks! I'm trying to encrypt EBS volumes created by a "ManagedNodeGroups" in my EKS cluster. according to the aws documentation, I added a launch template, with encryption configuration:

launchTemplate, err := ec2.NewLaunchTemplate(ctx, fmt.Sprintf("%s-eks-launch-template", environment), &ec2.LaunchTemplateArgs{
		Name:           pulumi.Sprintf("%s-eks-launch-template", environment),
		Tags:           defaultTags,
		DefaultVersion: pulumi.Int(1),
		BlockDeviceMappings: ec2.LaunchTemplateBlockDeviceMappingArray{
			&ec2.LaunchTemplateBlockDeviceMappingArgs{
				DeviceName: pulumi.String("/dev/xvda"),
				Ebs: &ec2.LaunchTemplateBlockDeviceMappingEbsArgs{
					DeleteOnTermination: pulumi.String("true"),
					VolumeSize:          pulumi.Int(20), // 20 GB volume
					Encrypted:           pulumi.String("true"),
					VolumeType:          pulumi.String("gp2"),
					KmsKeyId:            pulumi.String(key.Arn),
				},
			},
		},
	})
	
	 eks.NewManagedNodeGroup(ctx, fmt.Sprintf("%s-eks-managed-node-group", environment), &eks.ManagedNodeGroupArgs{
		NodeGroupName: pulumi.Sprintf("%s-eks-managed-node-group", environment),
		Cluster:       eksCluster,
		ClusterName:   eksClusterName,
		NodeRoleArn:   executionRole.Arn,
		SubnetIds:     privateSubnets,
		LaunchTemplate: &classicEKS.NodeGroupLaunchTemplateArgs{
			Id:      launchTemplate.ID(),
			Version: pulumi.String("$Latest"),
		},
		ScalingConfig: &classicEKS.NodeGroupScalingConfigArgs{
			DesiredSize: pulumi.Int(minSize),
			MaxSize: pulumi.Int(minSize * 2),
			MinSize: pulumi.Int(minSize),
		},
		CapacityType: pulumi.String(capacityType),
		AmiType: pulumi.String("BOTTLEROCKET_x86_64"),
		Version: pulumi.String("1.31"),
		InstanceTypes: pulumi.StringArray{
			pulumi.String(instanceType),
		},
		Tags: defaultTags,
	})

But this is just creating another volumes and templates and keep existing default templates and volumes (like explained here: https://stackoverflow.com/questions/76653246/terraform-aws-creates-two-launch-templates-while-creating-eks-cluster-managed) what is the correct way to handle this ?

Can you try setting the launch template version to the

latestVersion

output of

launchTemplate

? That should correctly work IIRC

it's still creating two template, the one I declared in the code and the one automatically created with "auto scaling node group" I think it's not possible to customize this one

EKS might create an additional template nevertheless, I'm not sure about how it handles that internally. Just to confirm, your nodes are using the correct template though?

yes the managed node group is using the template

Great! The option with specifying both block device mappings should also work