Karpenter Example

Configuration in this directory creates an AWS EKS cluster with Karpenter provisioned for managing compute resource scaling.

Usage

To run this example you need to execute:

$ terraform init
$ terraform plan
$ terraform apply

Once the cluster is up and running, you can check that Karpenter is functioning as intended with the following command:

# First, make sure you have updated your local kubeconfig
aws eks --region eu-west-1 update-kubeconfig --name ex-karpenter

# Second, scale the example deployment
kubectl scale deployment inflate --replicas 5

# You can watch Karpenter's controller logs with
kubectl logs -f -n karpenter -l app.kubernetes.io/name=karpenter -c controller

You should see a new node named karpenter.sh/provisioner-name/default eventually come up in the console; this was provisioned by Karpenter in response to the scaled deployment above.

Tear Down & Clean-Up

Because Karpenter manages the state of node resources outside of Terraform, Karpenter created resources will need to be de-provisioned first before removing the remaining resources with Terraform.

Remove the example deployment created above and any nodes created by Karpenter

kubectl delete deployment inflate
kubectl delete node -l karpenter.sh/provisioner-name=default

Remove the resources created by Terraform

terraform destroy

Note that this example may create resources which cost money. Run terraform destroy when you don't need these resources.

Requirements

Name	Version
terraform	>= 0.13.1
aws	>= 3.72
helm	>= 2.4
kubectl	>= 1.14

Providers

Name	Version
aws	>= 3.72
helm	>= 2.4
kubectl	>= 1.14

Modules

Name	Source	Version
eks	../..	n/a
karpenter_irsa	terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks	~> 4.21.1
vpc	terraform-aws-modules/vpc/aws	~> 3.0

Resources

Name	Type
aws_iam_instance_profile.karpenter	resource
helm_release.karpenter	resource
kubectl_manifest.karpenter_example_deployment	resource
kubectl_manifest.karpenter_provisioner	resource
aws_partition.current	data source

Inputs

No inputs.

Outputs

Name	Description
aws_auth_configmap_yaml	Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles
cloudwatch_log_group_arn	Arn of cloudwatch log group created
cloudwatch_log_group_name	Name of cloudwatch log group created
cluster_addons	Map of attribute maps for all EKS cluster addons enabled
cluster_arn	The Amazon Resource Name (ARN) of the cluster
cluster_certificate_authority_data	Base64 encoded certificate data required to communicate with the cluster
cluster_endpoint	Endpoint for your Kubernetes API server
cluster_iam_role_arn	IAM role ARN of the EKS cluster
cluster_iam_role_name	IAM role name of the EKS cluster
cluster_iam_role_unique_id	Stable and unique string identifying the IAM role
cluster_id	The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready
cluster_identity_providers	Map of attribute maps for all EKS identity providers enabled
cluster_oidc_issuer_url	The URL on the EKS cluster for the OpenID Connect identity provider
cluster_platform_version	Platform version for the cluster
cluster_primary_security_group_id	Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console
cluster_security_group_arn	Amazon Resource Name (ARN) of the cluster security group
cluster_security_group_id	ID of the cluster security group
cluster_status	Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`
eks_managed_node_groups	Map of attribute maps for all EKS managed node groups created
eks_managed_node_groups_autoscaling_group_names	List of the autoscaling group names created by EKS managed node groups
fargate_profiles	Map of attribute maps for all EKS Fargate Profiles created
node_security_group_arn	Amazon Resource Name (ARN) of the node shared security group
node_security_group_id	ID of the node shared security group
oidc_provider	The OpenID Connect identity provider (issuer URL without leading `https://`)
oidc_provider_arn	The ARN of the OIDC Provider if `enable_irsa = true`
self_managed_node_groups	Map of attribute maps for all self managed node groups created
self_managed_node_groups_autoscaling_group_names	List of the autoscaling group names created by self-managed node groups