From 59d419110b51b79ab3dd263bc87c6988396d7e83 Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Wed, 25 Jun 2025 14:31:37 -0400
Subject: [PATCH 1/2] remove version from subchart

---
 main.tf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/main.tf b/main.tf
index 5affc44..2701bc1 100644
--- a/main.tf
+++ b/main.tf
@@ -98,7 +98,6 @@ resource "helm_release" "nodepool_resources" {
   name        = "nodepool-resources"
   description = "Kubernetes Node Autoscaling: built for flexibility, performance, and simplicity"
   chart       = "./karpenter-resources"
-  version     = local.module_version
   namespace   = var.namespace
 
   values = [

From a67063943fcd75f77494548654f693109edfed0e Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Wed, 9 Jul 2025 18:39:36 -0400
Subject: [PATCH 2/2] add service-linked role

---
 README.md |  1 +
 main.tf   | 19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a6b5f0d..dac6793 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 
 | Name | Type |
 |------|------|
+| [aws_iam_service_linked_role.spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
 | [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.nodepool_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
diff --git a/main.tf b/main.tf
index 2701bc1..693b262 100644
--- a/main.tf
+++ b/main.tf
@@ -3,7 +3,7 @@ locals {
   amd_ami_alias  = "bottlerocket@latest"
 
   # Calculate the role name with prefix
-  role_name_raw = format("%v%v-%v", local.prefixes["eks-role"], var.cluster_name, "karpenter-")
+  role_name_raw = format("%v%v-%v", local.prefixes["eks-role"], var.cluster_name, "karpenter")
 
   # Ensure role name stays within AWS limits (38 chars) when used as name_prefix
   max_role_name_length = 37
@@ -59,7 +59,8 @@ data "aws_ecr_image" "karpenter_image" {
 
 resource "helm_release" "karpenter" {
   depends_on = [
-    data.aws_ecr_image.karpenter_image
+    data.aws_ecr_image.karpenter_image,
+    aws_iam_service_linked_role.spot
   ]
   name             = "karpenter"
   chart            = "karpenter"
@@ -114,3 +115,17 @@ resource "helm_release" "nodepool_resources" {
   timeout = 600
   wait    = true
 }
+
+# Create service-linked role for EC2 Spot (required for Karpenter spot instances)
+resource "aws_iam_service_linked_role" "spot" {
+  aws_service_name = "spot.amazonaws.com"
+  description      = "Service-linked role for EC2 Spot instances used by Karpenter"
+
+  # This will only create the role if it doesn't already exist
+  # If it exists, Terraform will import the existing role
+  lifecycle {
+    ignore_changes = [
+      description,
+    ]
+  }
+}