Merge branch 'mcmCluster' into test/clean-up-values

README.md

@@ -43,12 +43,15 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 | [helm_release.nodepool_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
+| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
 | [aws_ecr_image.karpenter_image](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_image) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
 | <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
 | <a name="input_karpenter_helm_chart"></a> [karpenter\_helm\_chart](#input\_karpenter\_helm\_chart) | Which helm chart of karpenter | `string` | `"1.1.1"` | no |

copy_images.tf

@@ -1,21 +1,20 @@
 locals {
-  karpenter_key = format("%v#%v", "karpenter/controller", var.karpenter_tag)
+  karpenter_key  = format("%v#%v", "karpenter/controller", var.karpenter_tag)
+  ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images")
 
   image_config = [
     {
       enabled         = true
       dest_path       = null
       name            = "karpenter/controller"
       source_image    = "karpenter/controller"
-      source_registry = "public.ecr.aws"
+      source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr")
       source_tag      = var.karpenter_tag
       tag             = var.karpenter_tag
     },
   ]
 }
 
-# 224384469011.dkr.ecr.us-gov-east-1.amazonaws.com/platform-test-1/karpenter:0.37.0
-#  map[repository:224384469011.dkr.ecr.us-gov-east-1.amazonaws.com/platform-test-1/karpenter tag:0.37.0]
 module "images" {
   source = "git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade"
 
@@ -27,5 +26,19 @@ module "images" {
   enable_lifecycle_policy     = true
   lifecycle_policy_all        = true
   force_delete                = true
-  lifecycle_policy_keep_count = 3
+  lifecycle_policy_keep_count = 5
+
+  source_username = data.aws_ecr_authorization_token.ecr_token.user_name
+  source_password = data.aws_ecr_authorization_token.ecr_token.password
+
+  destination_username = data.aws_ecr_authorization_token.token.user_name
+  destination_password = data.aws_ecr_authorization_token.token.password
+}
+
+data "aws_ecr_authorization_token" "ecr_token" {
+  registry_id = var.account_id
+}
+
+data "aws_ecr_authorization_token" "token" {
+  registry_id = var.account_id
 }

karpenter/values.yaml.tpl

@@ -48,6 +48,19 @@ tolerations:
     operator: Exists
     effect: NoSchedule
 
+nodeSelector:
+  kubernetes.io/os: linux
+
+tolerations:
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - key: node-role.kubernetes.io/master
+    operator: Exists
+    effect: NoSchedule
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
 affinity:
   nodeAffinity:
     requiredDuringSchedulingIgnoredDuringExecution:

main.tf

@@ -31,8 +31,6 @@ module "karpenter_resources" {
   enable_irsa                     = false
   enable_pod_identity             = true
   enable_v1_permissions           = true
-  # irsa_namespace_service_accounts = ["${var.namespace}:karpenter"]
-  # irsa_oidc_provider_arn          = var.oidc_provider_arn
   node_iam_role_name              = local.node_iam_role_name
   queue_name                      = local.queue_name
   rule_name_prefix                = local.rule_name_prefix

variables.tf

@@ -1,32 +1,23 @@
-variable "region" {
-  description = "AWS region"
-  type        = string
-}
-
-variable "profile" {
-  description = "AWS config profile"
+variable "account_id" {
+  description = "aws account number"
   type        = string
   default     = ""
 }
 
-variable "cluster_name" {
-  description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
-  type        = string
-}
-
 variable "cluster_endpoint" {
   description = "Endpoint for your Kubernetes API server"
   type        = string
 }
 
-variable "oidc_provider_arn" {
-  description = "The ARN of the OIDC Provider if `enable_irsa = true`"
+variable "cluster_name" {
+  description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
   type        = string
 }
 
-variable "karpenter_node_group_name" {
-  description = "The cluster node group that will host karpenter, should not be a karpenter managed node group"
+variable "karpenter_helm_chart" {
+  description = "Which helm chart of karpenter"
   type        = string
+  default     = "1.1.1"
 }
 
 variable "karpenter_helm_repo" {
@@ -36,10 +27,9 @@ variable "karpenter_helm_repo" {
   # default     = "https://charts.karpenter.sh/"  public.ecr.aws/karpenter/karpenter:0.37.0
 }
 
-variable "karpenter_helm_chart" {
-  description = "Which helm chart of karpenter"
+variable "karpenter_node_group_name" {
+  description = "The cluster node group that will host karpenter, should not be a karpenter managed node group"
   type        = string
-  default     = "1.1.1"
 }
 
 variable "karpenter_tag" {
@@ -48,6 +38,28 @@ variable "karpenter_tag" {
   default     = "1.1.1"
 }
 
+variable "namespace" {
+  description = "Namespace for Karpenter"
+  type        = string
+  default     = "namespace"
+}
+
+variable "oidc_provider_arn" {
+  description = "The ARN of the OIDC Provider if `enable_irsa = true`"
+  type        = string
+}
+
+variable "profile" {
+  description = "AWS config profile"
+  type        = string
+  default     = ""
+}
+
+variable "region" {
+  description = "AWS region"
+  type        = string
+}
+
 variable "subnets_name" {
   description = "Define the name of the subnets to be used by this cluster"
   type        = string
@@ -59,14 +71,3 @@ variable "tags" {
   type        = map(string)
   default     = {}
 }
-
-variable "namespace" {
-  description = "Namespace for Karpenter"
-  type        = string
-  default     = "namespace"
-}
-
-# variable "vpc_id" {
-#   description = "The ID of the VPC where the resources will be deployed"
-#   type        = string
-# }