From 0c9eb123d14b8731a00a2a611f9a643178ad7b6f Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 21 Oct 2025 16:20:43 -0400 Subject: [PATCH 1/6] =?UTF-8?q?=E2=9C=A8=20feat(aws-provider-6.0):=20updat?= =?UTF-8?q?e=20helm=20chart=20and=20provider=20for=20upstream=20changes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 7 ++----- copy_images.tf | 43 ++++++++++++++++++++++--------------------- main.tf | 8 ++------ variables.tf | 2 ++ 4 files changed, 28 insertions(+), 32 deletions(-) diff --git a/README.md b/README.md index e38ebc1..fe19e29 100644 --- a/README.md +++ b/README.md @@ -26,8 +26,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.100.0 | -| [aws.eecr](#provider\_aws.eecr) | 5.100.0 | +| [aws](#provider\_aws) | 6.15.0 | | [helm](#provider\_helm) | 3.0.2 | | [null](#provider\_null) | 3.2.4 | @@ -36,7 +35,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Source | Version | |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade | -| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v20.37.2 | +| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.4.0 | ## Resources @@ -47,8 +46,6 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | -| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_image.karpenter_image](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_image) | data source | ## Inputs diff --git a/copy_images.tf b/copy_images.tf index daa4606..957b5ac 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,6 +1,6 @@ locals { - karpenter_key = format("%v#%v", "karpenter/controller", var.karpenter_tag) - ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + karpenter_key = format("%v#%v", "karpenter/controller", var.karpenter_tag) + # ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { @@ -8,9 +8,10 @@ locals { dest_path = null name = "karpenter/controller" source_image = "karpenter/controller" - source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") - source_tag = var.karpenter_tag - tag = var.karpenter_tag + source_registry = "public.ecr.aws" + # source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_tag = var.karpenter_tag + tag = var.karpenter_tag }, ] } @@ -28,27 +29,27 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password + # source_username = data.aws_ecr_authorization_token.ecr_token.user_name + # source_password = data.aws_ecr_authorization_token.ecr_token.password - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password + # destination_username = data.aws_ecr_authorization_token.token.user_name + # destination_password = data.aws_ecr_authorization_token.token.password } -data "aws_ecr_authorization_token" "token" { - registry_id = var.account_id -} +# data "aws_ecr_authorization_token" "token" { +# registry_id = var.account_id +# } -data "aws_ecr_authorization_token" "ecr_token" { - provider = aws.eecr - registry_id = var.eecr_info.account_id -} +# data "aws_ecr_authorization_token" "ecr_token" { +# provider = aws.eecr +# registry_id = var.eecr_info.account_id +# } -provider "aws" { - alias = "eecr" - profile = var.eecr_info.profile - region = var.eecr_info.region -} +# provider "aws" { +# alias = "eecr" +# profile = var.eecr_info.profile +# region = var.eecr_info.region +# } output "image_config" { description = "Map of image references to their full source paths" diff --git a/main.tf b/main.tf index ffbc633..a45e508 100644 --- a/main.tf +++ b/main.tf @@ -21,18 +21,14 @@ locals { # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter # Karpenter IRSA roles and policies module "karpenter_resources" { - source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v20.37.2" + source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.4.0" cluster_name = var.cluster_name create_access_entry = true create_instance_profile = true create_node_iam_role = true create_pod_identity_association = true - enable_irsa = true - irsa_namespace_service_accounts = ["${var.namespace}:karpenter"] - irsa_oidc_provider_arn = var.oidc_provider_arn - enable_pod_identity = true - enable_v1_permissions = true + namespace = var.namespace node_iam_role_name = local.node_iam_role_name queue_name = local.queue_name rule_name_prefix = local.rule_name_prefix diff --git a/variables.tf b/variables.tf index 1cd76ec..8a23f33 100644 --- a/variables.tf +++ b/variables.tf @@ -1,3 +1,4 @@ +# tflint-ignore: terraform_unused_declarations variable "account_id" { description = "aws account number" type = string @@ -14,6 +15,7 @@ variable "cluster_name" { type = string } +# tflint-ignore: terraform_unused_declarations variable "eecr_info" { description = "Enterprise ECR source information" type = object({ From c3ff8e44374461f5ef24154d404cb3b8d259e5b5 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 23 Oct 2025 18:08:50 -0400 Subject: [PATCH 2/6] bump to latest --- README.md | 2 +- main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index fe19e29..e065677 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Source | Version | |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade | -| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.4.0 | +| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.6.1 | ## Resources diff --git a/main.tf b/main.tf index a45e508..8a2195b 100644 --- a/main.tf +++ b/main.tf @@ -21,7 +21,7 @@ locals { # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter # Karpenter IRSA roles and policies module "karpenter_resources" { - source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.4.0" + source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.6.1" cluster_name = var.cluster_name create_access_entry = true From 88611c484274b6550fdf6251f086c2bdd1fe3598 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 12 Jan 2026 19:28:25 -0500 Subject: [PATCH 3/6] bump --- README.md | 2 +- main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e065677..f487b89 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Source | Version | |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade | -| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.6.1 | +| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.11.0 | ## Resources diff --git a/main.tf b/main.tf index 8a2195b..a3fa351 100644 --- a/main.tf +++ b/main.tf @@ -21,7 +21,7 @@ locals { # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter # Karpenter IRSA roles and policies module "karpenter_resources" { - source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.6.1" + source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.11.0" cluster_name = var.cluster_name create_access_entry = true From b6619730158b1fd5d6e0292ac209546bfa056547 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 16 Jan 2026 14:49:37 -0500 Subject: [PATCH 4/6] undo eecr workaround --- README.md | 3 +++ copy_images.tf | 52 +++++++++++++++++++++++++------------------------- 2 files changed, 29 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index f487b89..3dff98b 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Version | |------|---------| | [aws](#provider\_aws) | 6.15.0 | +| [aws.eecr](#provider\_aws.eecr) | 6.15.0 | | [helm](#provider\_helm) | 3.0.2 | | [null](#provider\_null) | 3.2.4 | @@ -46,6 +47,8 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_image.karpenter_image](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_image) | data source | ## Inputs diff --git a/copy_images.tf b/copy_images.tf index 957b5ac..d6e9145 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,17 +1,17 @@ locals { - karpenter_key = format("%v#%v", "karpenter/controller", var.karpenter_tag) - # ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + karpenter_key = format("%v#%v", "karpenter/controller", var.karpenter_tag) + ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { - enabled = true - dest_path = null - name = "karpenter/controller" - source_image = "karpenter/controller" - source_registry = "public.ecr.aws" - # source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") - source_tag = var.karpenter_tag - tag = var.karpenter_tag + enabled = true + dest_path = null + name = "karpenter/controller" + source_image = "karpenter/controller" + # source_registry = "public.ecr.aws" + source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_tag = var.karpenter_tag + tag = var.karpenter_tag }, ] } @@ -29,27 +29,27 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - # source_username = data.aws_ecr_authorization_token.ecr_token.user_name - # source_password = data.aws_ecr_authorization_token.ecr_token.password + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password - # destination_username = data.aws_ecr_authorization_token.token.user_name - # destination_password = data.aws_ecr_authorization_token.token.password + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password } -# data "aws_ecr_authorization_token" "token" { -# registry_id = var.account_id -# } +data "aws_ecr_authorization_token" "token" { + registry_id = var.account_id +} -# data "aws_ecr_authorization_token" "ecr_token" { -# provider = aws.eecr -# registry_id = var.eecr_info.account_id -# } +data "aws_ecr_authorization_token" "ecr_token" { + provider = aws.eecr + registry_id = var.eecr_info.account_id +} -# provider "aws" { -# alias = "eecr" -# profile = var.eecr_info.profile -# region = var.eecr_info.region -# } +provider "aws" { + alias = "eecr" + profile = var.eecr_info.profile + region = var.eecr_info.region +} output "image_config" { description = "Map of image references to their full source paths" From 47b7a7a3d40c03c33ea7acdc3f3a7c17440853d2 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 20 Jan 2026 12:32:57 -0500 Subject: [PATCH 5/6] =?UTF-8?q?=F0=9F=93=A6=EF=B8=8F=20package(copy=5Fimag?= =?UTF-8?q?es.tf):=20update=20the=20source=20to=20pull=20karpenter=20via?= =?UTF-8?q?=20ironbank?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- copy_images.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index d6e9145..8ef9d2f 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -7,9 +7,9 @@ locals { enabled = true dest_path = null name = "karpenter/controller" - source_image = "karpenter/controller" + source_image = "opensource/aws/karpenter/controller" # source_registry = "public.ecr.aws" - source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.karpenter_tag tag = var.karpenter_tag }, From f618e618e639dd8fe4aff438366cf94103d3953c Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 20 Jan 2026 15:06:03 -0500 Subject: [PATCH 6/6] chore(service-linked-roles) add var and count to gate creation of spot role --- README.md | 2 ++ main.tf | 27 ++++++++++++++------------- variables.tf | 6 ++++++ 3 files changed, 22 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 3dff98b..e40241c 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Type | |------|------| +| [aws_iam_service_linked_role.spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource | | [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [helm_release.nodepool_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | @@ -58,6 +59,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | | [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | +| [create\_spot\_service\_linked\_role](#input\_create\_spot\_service\_linked\_role) | Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances) | `bool` | `false` | no | | [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | 
object({
    account_id = string
    alias      = string
    profile    = string
    region     = string
  })
| 
{
  "account_id": "269222635945",
  "alias": "lab-gov-shared-nonprod",
  "profile": "269222635945-lab-gov-shared-nonprod",
  "region": "us-gov-east-1"
}
| no | | [karpenter\_helm\_chart](#input\_karpenter\_helm\_chart) | Which helm chart of karpenter | `string` | `"1.1.1"` | no | | [karpenter\_helm\_repo](#input\_karpenter\_helm\_repo) | Helm repo for official karpenter chart | `string` | `"oci://public.ecr.aws/karpenter"` | no | diff --git a/main.tf b/main.tf index a3fa351..acd95a6 100644 --- a/main.tf +++ b/main.tf @@ -56,7 +56,7 @@ data "aws_ecr_image" "karpenter_image" { resource "helm_release" "karpenter" { depends_on = [ data.aws_ecr_image.karpenter_image, - # aws_iam_service_linked_role.spot + aws_iam_service_linked_role.spot ] name = "karpenter" chart = "karpenter" @@ -113,15 +113,16 @@ resource "helm_release" "nodepool_resources" { } # Create service-linked role for EC2 Spot (required for Karpenter spot instances) -# resource "aws_iam_service_linked_role" "spot" { -# aws_service_name = "spot.amazonaws.com" -# description = "Service-linked role for EC2 Spot instances used by Karpenter" - -# # This will only create the role if it doesn't already exist -# # If it exists, Terraform will import the existing role -# lifecycle { -# ignore_changes = [ -# description, -# ] -# } -# } +resource "aws_iam_service_linked_role" "spot" { + count = var.create_spot_service_linked_role ? 1 : 0 + aws_service_name = "spot.amazonaws.com" + description = "Service-linked role for EC2 Spot instances used by Karpenter" + + # This will only create the role if it doesn't already exist + # If it exists, Terraform will import the existing role + lifecycle { + ignore_changes = [ + description, + ] + } +} diff --git a/variables.tf b/variables.tf index 8a23f33..d2bb162 100644 --- a/variables.tf +++ b/variables.tf @@ -91,3 +91,9 @@ variable "tags" { type = map(string) default = {} } + +variable "create_spot_service_linked_role" { + description = "Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances)" + type = bool + default = false +}