Merge pull request #27 from SCT-Engineering/update21.4.0

Update to latest release

README.md

@@ -26,8 +26,8 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.100.0 |
-| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 5.100.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.15.0 |
+| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 6.15.0 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 3.0.2 |
 | <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
 
@@ -36,12 +36,13 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade |
-| <a name="module_karpenter_resources"></a> [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v20.37.2 |
+| <a name="module_karpenter_resources"></a> [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.11.0 |
 
 ## Resources
 
 | Name | Type |
 |------|------|
+| [aws_iam_service_linked_role.spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
 | [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.nodepool_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
@@ -58,6 +59,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 | <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
 | <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
+| <a name="input_create_spot_service_linked_role"></a> [create\_spot\_service\_linked\_role](#input\_create\_spot\_service\_linked\_role) | Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances) | `bool` | `false` | no |
 | <a name="input_eecr_info"></a> [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | <pre>object({<br/>    account_id = string<br/>    alias      = string<br/>    profile    = string<br/>    region     = string<br/>  })</pre> | <pre>{<br/>  "account_id": "269222635945",<br/>  "alias": "lab-gov-shared-nonprod",<br/>  "profile": "269222635945-lab-gov-shared-nonprod",<br/>  "region": "us-gov-east-1"<br/>}</pre> | no |
 | <a name="input_karpenter_helm_chart"></a> [karpenter\_helm\_chart](#input\_karpenter\_helm\_chart) | Which helm chart of karpenter | `string` | `"1.1.1"` | no |
 | <a name="input_karpenter_helm_repo"></a> [karpenter\_helm\_repo](#input\_karpenter\_helm\_repo) | Helm repo for official karpenter chart | `string` | `"oci://public.ecr.aws/karpenter"` | no |

copy_images.tf

@@ -4,11 +4,12 @@ locals {
 
   image_config = [
     {
-      enabled         = true
-      dest_path       = null
-      name            = "karpenter/controller"
-      source_image    = "karpenter/controller"
-      source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr")
+      enabled      = true
+      dest_path    = null
+      name         = "karpenter/controller"
+      source_image = "opensource/aws/karpenter/controller"
+      # source_registry = "public.ecr.aws"
+      source_registry = format("%v/%v", local.ent_ecr_source, "ironbank")
       source_tag      = var.karpenter_tag
       tag             = var.karpenter_tag
     },

main.tf

@@ -21,18 +21,14 @@ locals {
 # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter
 # Karpenter IRSA roles and policies
 module "karpenter_resources" {
-  source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v20.37.2"
+  source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.11.0"
 
   cluster_name                    = var.cluster_name
   create_access_entry             = true
   create_instance_profile         = true
   create_node_iam_role            = true
   create_pod_identity_association = true
-  enable_irsa                     = true
-  irsa_namespace_service_accounts = ["${var.namespace}:karpenter"]
-  irsa_oidc_provider_arn          = var.oidc_provider_arn
-  enable_pod_identity             = true
-  enable_v1_permissions           = true
+  namespace                       = var.namespace
   node_iam_role_name              = local.node_iam_role_name
   queue_name                      = local.queue_name
   rule_name_prefix                = local.rule_name_prefix
@@ -60,7 +56,7 @@ data "aws_ecr_image" "karpenter_image" {
 resource "helm_release" "karpenter" {
   depends_on = [
     data.aws_ecr_image.karpenter_image,
-    # aws_iam_service_linked_role.spot
+    aws_iam_service_linked_role.spot
   ]
   name             = "karpenter"
   chart            = "karpenter"
@@ -117,15 +113,16 @@ resource "helm_release" "nodepool_resources" {
 }
 
 # Create service-linked role for EC2 Spot (required for Karpenter spot instances)
-# resource "aws_iam_service_linked_role" "spot" {
-#   aws_service_name = "spot.amazonaws.com"
-#   description      = "Service-linked role for EC2 Spot instances used by Karpenter"
-
-#   # This will only create the role if it doesn't already exist
-#   # If it exists, Terraform will import the existing role
-#   lifecycle {
-#     ignore_changes = [
-#       description,
-#     ]
-#   }
-# }
+resource "aws_iam_service_linked_role" "spot" {
+  count            = var.create_spot_service_linked_role ? 1 : 0
+  aws_service_name = "spot.amazonaws.com"
+  description      = "Service-linked role for EC2 Spot instances used by Karpenter"
+
+  # This will only create the role if it doesn't already exist
+  # If it exists, Terraform will import the existing role
+  lifecycle {
+    ignore_changes = [
+      description,
+    ]
+  }
+}

variables.tf

@@ -1,3 +1,4 @@
+# tflint-ignore: terraform_unused_declarations
 variable "account_id" {
   description = "aws account number"
   type        = string
@@ -14,6 +15,7 @@ variable "cluster_name" {
   type        = string
 }
 
+# tflint-ignore: terraform_unused_declarations
 variable "eecr_info" {
   description = "Enterprise ECR source information"
   type = object({
@@ -89,3 +91,9 @@ variable "tags" {
   type        = map(string)
   default     = {}
 }
+
+variable "create_spot_service_linked_role" {
+  description = "Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances)"
+  type        = bool
+  default     = false
+}