From 84b5a7080cc945be2c46c0f05334f056ee5a4923 Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Tue, 24 Jun 2025 18:17:52 -0400
Subject: [PATCH] update sources

---
 README.md      | 11 ++++++-----
 copy_images.tf |  7 ++++++-
 main.tf        |  4 ++++
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index b8dcb78..a6b5f0d 100644
--- a/README.md
+++ b/README.md
@@ -26,16 +26,16 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.94.1 |
-| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 5.94.1 |
-| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
-| <a name="provider_null"></a> [null](#provider\_null) | 3.2.3 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.0.0 |
+| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 6.0.0 |
+| <a name="provider_helm"></a> [helm](#provider\_helm) | 3.0.2 |
+| <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
 
 ## Modules
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
+| <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade |
 | <a name="module_karpenter_resources"></a> [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v20.36.0 |
 
 ## Resources
@@ -74,6 +74,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 
 | Name | Description |
 |------|-------------|
+| <a name="output_image_config"></a> [image\_config](#output\_image\_config) | Map of image references to their full source paths |
 | <a name="output_module_name"></a> [module\_name](#output\_module\_name) | The name of this module. |
 | <a name="output_module_version"></a> [module\_version](#output\_module\_version) | The version of this module. |
 <!-- END_TF_DOCS -->
diff --git a/copy_images.tf b/copy_images.tf
index 2d7e7c1..daa4606 100644
--- a/copy_images.tf
+++ b/copy_images.tf
@@ -16,7 +16,7 @@ locals {
 }
 
 module "images" {
-  source = "git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade"
+  source = "git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git?ref=tf-upgrade"
 
   profile          = var.profile
   application_name = var.cluster_name
@@ -49,3 +49,8 @@ provider "aws" {
   profile = var.eecr_info.profile
   region  = var.eecr_info.region
 }
+
+output "image_config" {
+  description = "Map of image references to their full source paths"
+  value       = local.image_config
+}
diff --git a/main.tf b/main.tf
index 3175de1..5affc44 100644
--- a/main.tf
+++ b/main.tf
@@ -39,6 +39,10 @@ module "karpenter_resources" {
   # Attach additional IAM policies to the Karpenter node IAM role
   node_iam_role_additional_policies = {
     AmazonSSMManagedInstanceCore = format("arn:%v:iam::%v:%v", data.aws_arn.current.partition, "aws", "policy/AmazonSSMManagedInstanceCore")
+    # NOTE(asnyder): The AWS CloudWatch Observability Add-on does not currently
+    # support IRSA or Pod Identities. See: https://github.com/aws/aws-for-fluent-bit/issues/784.
+    CloudWatchAgentServerPolicy = format("arn:%v:iam::aws:%v", data.aws_arn.current.partition, "policy/CloudWatchAgentServerPolicy")
+
   }
 
   tags = var.tags