From e8c65239b9dbb353806ec6426170ad010db1e94b Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 16 Jun 2026 14:01:00 -0400 Subject: [PATCH 1/4] add ami-type var and set to AL2023 --- README.md | 3 ++- main.tf | 9 ++++----- variables.tf | 6 ++++++ 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 9b59b4d..433db45 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Source | Version | |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git | tf-upgrade | -| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.15.1 | +| [karpenter\_resources](#module\_karpenter\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter | v21.23.0 | ## Resources @@ -57,6 +57,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | +| [ami\_type](#input\_ami\_type) | AMI type to use for the Karpenter node group | `string` | `"AL2023_x86_64"` | no | | [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [create\_spot\_service\_linked\_role](#input\_create\_spot\_service\_linked\_role) | Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances) | `bool` | `false` | no | diff --git a/main.tf b/main.tf index bfdc816..0c4692c 100644 --- a/main.tf +++ b/main.tf @@ -1,6 +1,7 @@ locals { - amd_ami_family = "Bottlerocket" - amd_ami_alias = "bottlerocket@latest" + ami_type_family = upper(split("_", var.ami_type)[0]) + amd_ami_family = local.ami_type_family == "BOTTLEROCKET" ? "Bottlerocket" : local.ami_type_family + amd_ami_alias = lower(format("%v@latest", local.amd_ami_family)) # Calculate the role name with prefix role_name_raw = format("%v%v-%v", local.prefixes["eks-role"], var.cluster_name, "karpenter") @@ -23,7 +24,7 @@ locals { # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter # Karpenter IRSA roles and policies module "karpenter_resources" { - source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.15.1" + source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.23.0" cluster_name = var.cluster_name create_access_entry = true @@ -42,8 +43,6 @@ module "karpenter_resources" { CloudWatchAgentServerPolicy = format("arn:%v:iam::aws:%v", data.aws_arn.current.partition, "policy/CloudWatchAgentServerPolicy") } - - tags = var.tags } # Install Karpenter diff --git a/variables.tf b/variables.tf index 98c5fd5..86661f8 100644 --- a/variables.tf +++ b/variables.tf @@ -97,3 +97,9 @@ variable "create_spot_service_linked_role" { type = bool default = false } + +variable "ami_type" { + description = "AMI type to use for the Karpenter node group" + type = string + default = "AL2023_x86_64" +} From ee69df23d5184ea58d0e3057ddea1b520b809180 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 16 Jun 2026 15:57:10 -0400 Subject: [PATCH 2/4] fix var --- README.md | 2 +- main.tf | 3 +-- variables.tf | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 433db45..d0f3fdd 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | -| [ami\_type](#input\_ami\_type) | AMI type to use for the Karpenter node group | `string` | `"AL2023_x86_64"` | no | +| [ami\_type](#input\_ami\_type) | AMI type to use for the Karpenter node group | `string` | `"AL2023_x86_64_STANDARD"` | no | | [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [create\_spot\_service\_linked\_role](#input\_create\_spot\_service\_linked\_role) | Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances) | `bool` | `false` | no | diff --git a/main.tf b/main.tf index 0c4692c..6456515 100644 --- a/main.tf +++ b/main.tf @@ -1,6 +1,6 @@ locals { ami_type_family = upper(split("_", var.ami_type)[0]) - amd_ami_family = local.ami_type_family == "BOTTLEROCKET" ? "Bottlerocket" : local.ami_type_family + amd_ami_family = local.ami_type_family amd_ami_alias = lower(format("%v@latest", local.amd_ami_family)) # Calculate the role name with prefix @@ -18,7 +18,6 @@ locals { rule_name_prefix = length(local.rule_name_raw) > local.max_rule_name_length ? substr(local.rule_name_raw, 0, local.max_rule_name_length) : local.rule_name_raw queue_name = format("%v%v", local.prefixes["eks-queue"], var.cluster_name) subnet_ids = try(tolist(var.subnets), []) - } # Replicating from here: https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/tree/master/modules/karpenter diff --git a/variables.tf b/variables.tf index 86661f8..ec5f5ce 100644 --- a/variables.tf +++ b/variables.tf @@ -101,5 +101,5 @@ variable "create_spot_service_linked_role" { variable "ami_type" { description = "AMI type to use for the Karpenter node group" type = string - default = "AL2023_x86_64" + default = "AL2023_x86_64_STANDARD" } From a0fd3286c6b29dbd511fa61ff1f04dc33dfc692a Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 16 Jun 2026 16:08:19 -0400 Subject: [PATCH 3/4] enable inline policy to avoid policy size limits --- main.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/main.tf b/main.tf index 6456515..f6909b9 100644 --- a/main.tf +++ b/main.tf @@ -26,6 +26,7 @@ module "karpenter_resources" { source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.23.0" cluster_name = var.cluster_name + enable_inline_policy = true create_access_entry = true create_instance_profile = true create_node_iam_role = true From 310f40747e6d242b78eefa5c050b33de7ea280f0 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 16 Jun 2026 16:49:57 -0400 Subject: [PATCH 4/4] removed default true options --- main.tf | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/main.tf b/main.tf index f6909b9..20b2712 100644 --- a/main.tf +++ b/main.tf @@ -25,16 +25,13 @@ locals { module "karpenter_resources" { source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks.git//modules/karpenter?ref=v21.23.0" - cluster_name = var.cluster_name - enable_inline_policy = true - create_access_entry = true - create_instance_profile = true - create_node_iam_role = true - create_pod_identity_association = true - namespace = var.namespace - node_iam_role_name = local.node_iam_role_name - queue_name = local.queue_name - rule_name_prefix = local.rule_name_prefix + cluster_name = var.cluster_name + enable_inline_policy = true + create_instance_profile = true + namespace = var.namespace + node_iam_role_name = local.node_iam_role_name + queue_name = local.queue_name + rule_name_prefix = local.rule_name_prefix # Attach additional IAM policies to the Karpenter node IAM role node_iam_role_additional_policies = { AmazonSSMManagedInstanceCore = format("arn:%v:iam::%v:%v", data.aws_arn.current.partition, "aws", "policy/AmazonSSMManagedInstanceCore")