From bd387d69fac5a431a426e12de786ab80aea112a6 Mon Sep 17 00:00:00 2001 From: Constantin Bugneac <11664677+Constantin07@users.noreply.github.com> Date: Tue, 28 Mar 2023 21:50:40 +0100 Subject: [PATCH] feat: Add optional list of policy ARNs for attachment to Karpenter IRSA (#2537) Co-authored-by: Bryant Biggs --- examples/karpenter/main.tf | 56 ++++++++++++++++++++++------------ modules/karpenter/README.md | 2 ++ modules/karpenter/main.tf | 7 +++++ modules/karpenter/variables.tf | 6 ++++ 4 files changed, 51 insertions(+), 20 deletions(-) diff --git a/examples/karpenter/main.tf b/examples/karpenter/main.tf index 497fab7..4e64b9b 100644 --- a/examples/karpenter/main.tf +++ b/examples/karpenter/main.tf @@ -84,6 +84,26 @@ module "eks" { coredns = { configuration_values = jsonencode({ computeType = "Fargate" + # Ensure that the we fully utilize the minimum amount of resources that are supplied by + # Fargate https://docs.aws.amazon.com/eks/latest/userguide/fargate-pod-configuration.html + # Fargate adds 256 MB to each pod's memory reservation for the required Kubernetes + # components (kubelet, kube-proxy, and containerd). Fargate rounds up to the following + # compute configuration that most closely matches the sum of vCPU and memory requests in + # order to ensure pods always have the resources that they need to run. + resources = { + limits = { + cpu = "0.25" + # We are targetting the smallest Task size of 512Mb, so we subtract 256Mb from the + # request/limit to ensure we can fit within that task + memory = "256M" + } + requests = { + cpu = "0.25" + # We are targetting the smallest Task size of 512Mb, so we subtract 256Mb from the + # request/limit to ensure we can fit within that task + memory = "256M" + } + } }) } } @@ -109,26 +129,18 @@ module "eks" { }, ] - fargate_profiles = merge( - { for i in range(3) : - "kube-system-${element(split("-", local.azs[i]), 2)}" => { - selectors = [ - { namespace = "kube-system" } - ] - # We want to create a profile per AZ for high availability - subnet_ids = [element(module.vpc.private_subnets, i)] - } - }, - { for i in range(3) : - "karpenter-${element(split("-", local.azs[i]), 2)}" => { - selectors = [ - { namespace = "karpenter" } - ] - # We want to create a profile per AZ for high availability - subnet_ids = [element(module.vpc.private_subnets, i)] - } - }, - ) + fargate_profiles = { + karpenter = { + selectors = [ + { namespace = "karpenter" } + ] + } + kube-system = { + selectors = [ + { namespace = "kube-system" } + ] + } + } tags = merge(local.tags, { # NOTE - if creating multiple security groups with this module, only tag the @@ -148,6 +160,10 @@ module "karpenter" { cluster_name = module.eks.cluster_name irsa_oidc_provider_arn = module.eks.oidc_provider_arn + policies = { + AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" + } + tags = local.tags } diff --git a/modules/karpenter/README.md b/modules/karpenter/README.md index 055b6de..89f5495 100644 --- a/modules/karpenter/README.md +++ b/modules/karpenter/README.md @@ -124,6 +124,7 @@ No modules. | [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.irsa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.irsa_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_sqs_queue.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource | | [aws_sqs_queue_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource | @@ -169,6 +170,7 @@ No modules. | [irsa\_tag\_key](#input\_irsa\_tag\_key) | Tag key (`{key = value}`) applied to resources launched by Karpenter through the Karpenter provisioner | `string` | `"karpenter.sh/discovery"` | no | | [irsa\_tags](#input\_irsa\_tags) | A map of additional tags to add the the IAM role for service accounts | `map(any)` | `{}` | no | | [irsa\_use\_name\_prefix](#input\_irsa\_use\_name\_prefix) | Determines whether the IAM role for service accounts name (`irsa_name`) is used as a prefix | `bool` | `true` | no | +| [policies](#input\_policies) | Policies to attach to the IAM role in `{'static_name' = 'policy_arn'}` format | `map(string)` | `{}` | no | | [queue\_kms\_data\_key\_reuse\_period\_seconds](#input\_queue\_kms\_data\_key\_reuse\_period\_seconds) | The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again | `number` | `null` | no | | [queue\_kms\_master\_key\_id](#input\_queue\_kms\_master\_key\_id) | The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK | `string` | `null` | no | | [queue\_managed\_sse\_enabled](#input\_queue\_managed\_sse\_enabled) | Boolean to enable server-side encryption (SSE) of message content with SQS-owned encryption keys | `bool` | `true` | no | diff --git a/modules/karpenter/main.tf b/modules/karpenter/main.tf index f7d9f3e..cdbfb13 100644 --- a/modules/karpenter/main.tf +++ b/modules/karpenter/main.tf @@ -175,6 +175,13 @@ resource "aws_iam_role_policy_attachment" "irsa" { policy_arn = aws_iam_policy.irsa[0].arn } +resource "aws_iam_role_policy_attachment" "irsa_additional" { + for_each = { for k, v in var.policies : k => v if local.create_irsa } + + role = aws_iam_role.irsa[0].name + policy_arn = each.value +} + ################################################################################ # Node Termination Queue ################################################################################ diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf index df15e7c..f92160f 100644 --- a/modules/karpenter/variables.tf +++ b/modules/karpenter/variables.tf @@ -74,6 +74,12 @@ variable "irsa_tags" { default = {} } +variable "policies" { + description = "Policies to attach to the IAM role in `{'static_name' = 'policy_arn'}` format" + type = map(string) + default = {} +} + variable "irsa_tag_key" { description = "Tag key (`{key = value}`) applied to resources launched by Karpenter through the Karpenter provisioner" type = string