Genesis/Initial development

.gitignore

@@ -0,0 +1,38 @@
+# Local .terraform directories
+**/.terraform/*
+
+# terraform lock file.
+**/.terraform.lock.hcl
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data,
+# such as password, private keys, and other secrets. These should not be
+# part of version control as they are data points which are potentially
+# sensitive and subject to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources
+# locally and so are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+

EC2NodeClass.yaml.tpl

@@ -0,0 +1,14 @@
+apiVersion: karpenter.k8s.aws/v1beta1
+kind: EC2NodeClass
+metadata:
+  name: default
+spec:
+  amiFamily: AL2
+  instanceProfile: "KarpenterNodeInstanceProfile-${cluster_name}"
+  subnetSelectorTerms:
+    - tags:
+        Name: "*-container-*"
+  securityGroupSelectorTerms:
+    - tags:
+        Name: "${cluster_name}-node"
+  tags: ${tags}

README.md

@@ -0,0 +1,70 @@
+# tfmod-karpenter
+
+Karpenter is an open source tool developed by AWS for cluster autoscaling (Horizontal Cluster Autoscaling - HCA). It automatically provisions and manages compute resources lifecycle by monitoring the scheduling status of pods and dynamically adjusting the cluster size with an efficient approach to utilization and cost. Effectly, Karpenter becomes a replacement to the legacy Cluster Autoscaler and is preferred given it improves flexibility and is more cluster aware. More specifically, Karpenter was designed to overcome some of the challenges presented by Cluster Autoscaler by providing simplified ways to:
+
+- Provision nodes based on workload requirements.
+- Create diverse node configurations by instance type, using flexible workload provisioner options. Instead of managing many specific custom node groups, Karpenter allows diverse workload capacity with a single, flexible provisioner.
+- Achieve improved pod scheduling at scale by quickly launching nodes and scheduling pods.
+
+ref: [Karpenter Best Practices](https://aws.github.io/aws-eks-best-practices/karpenter/)
+
+# CHANGELOG
+
+* 0.0.1 -- 2024-07-23
+  - Genesis/Initial development
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.14.0 |
+| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.11.0 |
+| <a name="requirement_kubectl"></a> [kubectl](#requirement\_kubectl) | >= 1.14.0 |
+| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.23.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.14.0 |
+| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.11.0 |
+| <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | >= 1.14.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_images"></a> [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | 2.0.2 |
+| <a name="module_karpenter_resources"></a> [karpenter\_resources](#module\_karpenter\_resources) | git@github.e.it.census.gov:SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v20.8.5 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_instance_profile.KarpenterNodeInstanceProfile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
+| [aws_iam_service_linked_role.ec2_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
+| [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [kubectl_manifest.karpenter_EC2NodeClass](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/resources/manifest) | resource |
+| [kubectl_manifest.karpenter_NodePool](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/resources/manifest) | resource |
+| [aws_ecr_image.karpenter_image](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_image) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
+| <a name="input_karpenter_helm_chart"></a> [karpenter\_helm\_chart](#input\_karpenter\_helm\_chart) | Which helm chart of karpenter | `string` | `"0.37.0"` | no |
+| <a name="input_karpenter_helm_repo"></a> [karpenter\_helm\_repo](#input\_karpenter\_helm\_repo) | Helm repo for official karpenter chart | `string` | `"oci://public.ecr.aws/karpenter"` | no |
+| <a name="input_karpenter_tag"></a> [karpenter\_tag](#input\_karpenter\_tag) | Which tag of karpenter image | `string` | `"0.37.0"` | no |
+| <a name="input_oidc_provider_arn"></a> [oidc\_provider\_arn](#input\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` | `string` | n/a | yes |
+| <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile | `string` | `""` | no |
+| <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
+
+## Outputs
+
+No outputs.
+<!-- END_TF_DOCS -->

copy_images.tf

@@ -0,0 +1,27 @@
+locals {
+  karpenter_key = format("%v#%v", "karpenter/controller", var.karpenter_tag)
+
+  image_config = [
+    {
+      enabled         = true
+      dest_path       = null
+      name            = "karpenter/controller"
+      source_image    = "karpenter/controller"
+      source_registry = "public.ecr.aws"
+      source_tag      = var.karpenter_tag
+      tag             = var.karpenter_tag
+    },
+  ]
+}
+
+# 224384469011.dkr.ecr.us-gov-east-1.amazonaws.com/platform-test-1/karpenter:0.37.0
+#  map[repository:224384469011.dkr.ecr.us-gov-east-1.amazonaws.com/platform-test-1/karpenter tag:0.37.0]
+
+module "images" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=2.0.2"
+
+  profile          = var.profile
+  application_name = var.cluster_name
+  image_config     = local.image_config
+  tags             = {}
+}

examples/simple/karpenter.tf

@@ -0,0 +1,12 @@
+module "karpenter" {
+  source = "../.."
+
+  region                    = var.region
+  profile                   = var.profile
+  cluster_name              = var.cluster_name
+  oidc_provider_arn         = var.oidc_provider_arn
+  cluster_endpoint          = var.cluster_endpoint
+  karpenter_node_group_name = var.karpenter_node_group_name
+
+  tags = var.tags
+}

examples/simple/providers.tf

@@ -0,0 +1,44 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    kubectl = {
+      source = "gavinbunney/kubectl"
+    }
+  }
+}
+
+provider "aws" {
+  profile = var.profile
+  region  = var.region
+}
+
+data "aws_eks_cluster" "cluster" {
+  name = var.cluster_name
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+  name = var.cluster_name
+}
+
+provider "kubernetes" {
+  host = data.aws_eks_cluster.cluster.endpoint
+
+  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+  token                  = data.aws_eks_cluster_auth.cluster.token
+}
+
+provider "helm" {
+  kubernetes {
+    host = data.aws_eks_cluster.cluster.endpoint
+
+    cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+    token                  = data.aws_eks_cluster_auth.cluster.token
+  }
+}
+
+provider "kubectl" {
+  host                   = data.aws_eks_cluster.cluster.endpoint
+  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
+  token                  = data.aws_eks_cluster_auth.cluster.token
+  load_config_file       = false
+}

examples/simple/variables.tf

@@ -0,0 +1,36 @@
+variable "region" {
+  description = "AWS region"
+  type        = string
+}
+
+variable "profile" {
+  description = "AWS config profile"
+  type        = string
+  default     = ""
+}
+
+variable "cluster_name" {
+  description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
+  type        = string
+}
+
+variable "cluster_endpoint" {
+  description = "Endpoint for your Kubernetes API server"
+  type        = string
+}
+
+variable "oidc_provider_arn" {
+  description = "The ARN of the OIDC Provider if `enable_irsa = true`"
+  type        = string
+}
+
+variable "karpenter_node_group_name" {
+  description = "The cluster node group that will host karpenter, should not be a karpenter managed node group"
+  type        = string
+}
+
+variable "tags" {
+  description = "AWS Tags to apply to appropriate resources"
+  type        = map(string)
+  default     = {}
+}