add service-linked role

README.md

@@ -42,6 +42,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 
 | Name | Type |
 |------|------|
+| [aws_iam_service_linked_role.spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
 | [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.nodepool_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |

main.tf

@@ -3,7 +3,7 @@ locals {
   amd_ami_alias  = "bottlerocket@latest"
 
   # Calculate the role name with prefix
-  role_name_raw = format("%v%v-%v", local.prefixes["eks-role"], var.cluster_name, "karpenter-")
+  role_name_raw = format("%v%v-%v", local.prefixes["eks-role"], var.cluster_name, "karpenter")
 
   # Ensure role name stays within AWS limits (38 chars) when used as name_prefix
   max_role_name_length = 37
@@ -59,7 +59,8 @@ data "aws_ecr_image" "karpenter_image" {
 
 resource "helm_release" "karpenter" {
   depends_on = [
-    data.aws_ecr_image.karpenter_image
+    data.aws_ecr_image.karpenter_image,
+    aws_iam_service_linked_role.spot
   ]
   name             = "karpenter"
   chart            = "karpenter"
@@ -114,3 +115,17 @@ resource "helm_release" "nodepool_resources" {
   timeout = 600
   wait    = true
 }
+
+# Create service-linked role for EC2 Spot (required for Karpenter spot instances)
+resource "aws_iam_service_linked_role" "spot" {
+  aws_service_name = "spot.amazonaws.com"
+  description      = "Service-linked role for EC2 Spot instances used by Karpenter"
+
+  # This will only create the role if it doesn't already exist
+  # If it exists, Terraform will import the existing role
+  lifecycle {
+    ignore_changes = [
+      description,
+    ]
+  }
+}