Skip to content

Commit 03820cf

Browse files
coord-ecoord-e
authored
Merge pull request #373 from cookpad/coord-e/backport-karpenter-v1-controller-policy-1-29
Enable to use Karpenter v1 controller policy (backport to 1.29)
2 parents 43fb03d + c171d0b commit 03820cf

File tree

4 files changed

+405
-0
lines changed

4 files changed

+405
-0
lines changed

‎modules/karpenter/controller_iam.tf

Lines changed: 392 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -645,3 +645,395 @@ data "aws_iam_policy_document" "karpenter_controller_v1_beta" {
645645
actions = ["eks:DescribeCluster"]
646646
}
647647
}
648+
649+
resource "aws_iam_role_policy_attachment" "karpenter_controller_v1" {
650+
count = var.v1 ? 1 : 0
651+
role = aws_iam_role.karpenter_controller.id
652+
policy_arn = aws_iam_policy.karpenter_controller_v1[0].arn
653+
}
654+
655+
resource "aws_iam_policy" "karpenter_controller_v1" {
656+
count = var.v1 ? 1 : 0
657+
name = "${var.cluster_config.iam_policy_name_prefix}KarpenterController-v1-${var.cluster_config.name}"
658+
policy = data.aws_iam_policy_document.karpenter_controller_v1.json
659+
}
660+
661+
data "aws_iam_policy_document" "karpenter_controller_v1" {
662+
statement {
663+
sid = "AllowScopedEC2InstanceAccessActions"
664+
effect = "Allow"
665+
666+
# tfsec:ignore:aws-iam-no-policy-wildcards
667+
resources = [
668+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}::image/*",
669+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}::snapshot/*",
670+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:security-group/*",
671+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:subnet/*",
672+
]
673+
674+
actions = [
675+
"ec2:RunInstances",
676+
"ec2:CreateFleet",
677+
]
678+
}
679+
680+
statement {
681+
sid = "AllowScopedEC2LaunchTemplateAccessActions"
682+
effect = "Allow"
683+
684+
# tfsec:ignore:aws-iam-no-policy-wildcards
685+
resources = [
686+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:launch-template/*",
687+
]
688+
689+
actions = [
690+
"ec2:RunInstances",
691+
"ec2:CreateFleet",
692+
]
693+
694+
condition {
695+
test = "StringEquals"
696+
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_config.name}"
697+
values = ["owned"]
698+
}
699+
700+
condition {
701+
test = "StringLike"
702+
variable = "aws:ResourceTag/karpenter.sh/nodepool"
703+
values = ["*"]
704+
}
705+
}
706+
707+
statement {
708+
sid = "AllowScopedEC2InstanceActionsWithTags"
709+
effect = "Allow"
710+
711+
# tfsec:ignore:aws-iam-no-policy-wildcards
712+
resources = [
713+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:fleet/*",
714+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:instance/*",
715+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:volume/*",
716+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:network-interface/*",
717+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:launch-template/*",
718+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:spot-instances-request/*",
719+
]
720+
721+
actions = [
722+
"ec2:RunInstances",
723+
"ec2:CreateFleet",
724+
"ec2:CreateLaunchTemplate",
725+
]
726+
727+
condition {
728+
test = "StringEquals"
729+
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_config.name}"
730+
values = ["owned"]
731+
}
732+
733+
condition {
734+
test = "StringEquals"
735+
variable = "aws:RequestTag/eks:eks-cluster-name"
736+
values = [var.cluster_config.name]
737+
}
738+
739+
condition {
740+
test = "StringLike"
741+
variable = "aws:RequestTag/karpenter.sh/nodepool"
742+
values = ["*"]
743+
}
744+
}
745+
746+
statement {
747+
sid = "AllowScopedResourceCreationTagging"
748+
effect = "Allow"
749+
750+
# tfsec:ignore:aws-iam-no-policy-wildcards
751+
resources = [
752+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:fleet/*",
753+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:instance/*",
754+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:volume/*",
755+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:network-interface/*",
756+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:launch-template/*",
757+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:spot-instances-request/*",
758+
]
759+
760+
actions = ["ec2:CreateTags"]
761+
762+
condition {
763+
test = "StringEquals"
764+
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_config.name}"
765+
values = ["owned"]
766+
}
767+
768+
condition {
769+
test = "StringEquals"
770+
variable = "aws:RequestTag/eks:eks-cluster-name"
771+
values = [var.cluster_config.name]
772+
}
773+
774+
condition {
775+
test = "StringEquals"
776+
variable = "ec2:CreateAction"
777+
778+
values = [
779+
"RunInstances",
780+
"CreateFleet",
781+
"CreateLaunchTemplate",
782+
]
783+
}
784+
785+
condition {
786+
test = "StringLike"
787+
variable = "aws:RequestTag/karpenter.sh/nodepool"
788+
values = ["*"]
789+
}
790+
}
791+
792+
statement {
793+
sid = "AllowScopedResourceTagging"
794+
effect = "Allow"
795+
796+
# tfsec:ignore:aws-iam-no-policy-wildcards
797+
resources = ["arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:instance/*"]
798+
actions = ["ec2:CreateTags"]
799+
800+
condition {
801+
test = "StringEquals"
802+
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_config.name}"
803+
values = ["owned"]
804+
}
805+
806+
condition {
807+
test = "StringLike"
808+
variable = "aws:ResourceTag/karpenter.sh/nodepool"
809+
values = ["*"]
810+
}
811+
812+
condition {
813+
test = "StringEqualsIfExists"
814+
variable = "aws:RequestTag/eks:eks-cluster-name"
815+
values = [var.cluster_config.name]
816+
}
817+
818+
condition {
819+
test = "ForAllValues:StringEquals"
820+
variable = "aws:TagKeys"
821+
values = ["eks:eks-cluster-name", "karpenter.sh/nodeclaim", "Name"]
822+
}
823+
}
824+
825+
826+
statement {
827+
sid = "AllowScopedDeletion"
828+
effect = "Allow"
829+
830+
# tfsec:ignore:aws-iam-no-policy-wildcards
831+
resources = [
832+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:instance/*",
833+
"arn:${data.aws_partition.current.partition}:ec2:${data.aws_region.current.name}:*:launch-template/*",
834+
]
835+
836+
actions = [
837+
"ec2:TerminateInstances",
838+
"ec2:DeleteLaunchTemplate",
839+
]
840+
841+
condition {
842+
test = "StringEquals"
843+
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_config.name}"
844+
values = ["owned"]
845+
}
846+
847+
condition {
848+
test = "StringLike"
849+
variable = "aws:ResourceTag/karpenter.sh/nodepool"
850+
values = ["*"]
851+
}
852+
}
853+
854+
statement {
855+
sid = "AllowRegionalReadActions"
856+
effect = "Allow"
857+
resources = ["*"]
858+
859+
actions = [
860+
"ec2:DescribeAvailabilityZones",
861+
"ec2:DescribeImages",
862+
"ec2:DescribeInstances",
863+
"ec2:DescribeInstanceTypeOfferings",
864+
"ec2:DescribeInstanceTypes",
865+
"ec2:DescribeLaunchTemplates",
866+
"ec2:DescribeSecurityGroups",
867+
"ec2:DescribeSpotPriceHistory",
868+
"ec2:DescribeSubnets",
869+
]
870+
871+
condition {
872+
test = "StringEquals"
873+
variable = "aws:RequestedRegion"
874+
values = [data.aws_region.current.name]
875+
}
876+
}
877+
878+
statement {
879+
sid = "AllowSSMReadActions"
880+
effect = "Allow"
881+
resources = ["arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}::parameter/aws/service/*"]
882+
actions = ["ssm:GetParameter"]
883+
}
884+
885+
statement {
886+
sid = "AllowPricingReadActions"
887+
effect = "Allow"
888+
resources = ["*"]
889+
actions = ["pricing:GetProducts"]
890+
}
891+
892+
statement {
893+
sid = "AllowInterruptionQueueActions"
894+
effect = "Allow"
895+
resources = [aws_sqs_queue.karpenter_interruption.arn]
896+
897+
actions = [
898+
"sqs:DeleteMessage",
899+
"sqs:GetQueueUrl",
900+
"sqs:ReceiveMessage",
901+
]
902+
}
903+
904+
statement {
905+
sid = "AllowPassingInstanceRole"
906+
effect = "Allow"
907+
resources = concat([aws_iam_role.karpenter_node.arn], var.additional_node_role_arns)
908+
actions = ["iam:PassRole"]
909+
910+
condition {
911+
test = "StringEquals"
912+
variable = "iam:PassedToService"
913+
values = ["ec2.amazonaws.com"]
914+
}
915+
}
916+
917+
statement {
918+
sid = "AllowScopedInstanceProfileCreationActions"
919+
effect = "Allow"
920+
resources = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:instance-profile/*"]
921+
actions = ["iam:CreateInstanceProfile"]
922+
923+
condition {
924+
test = "StringEquals"
925+
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_config.name}"
926+
values = ["owned"]
927+
}
928+
929+
condition {
930+
test = "StringEquals"
931+
variable = "aws:RequestTag/eks:eks-cluster-name"
932+
values = [var.cluster_config.name]
933+
}
934+
935+
condition {
936+
test = "StringEquals"
937+
variable = "aws:RequestTag/topology.kubernetes.io/region"
938+
values = [data.aws_region.current.name]
939+
}
940+
941+
condition {
942+
test = "StringLike"
943+
variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
944+
values = ["*"]
945+
}
946+
}
947+
948+
statement {
949+
sid = "AllowScopedInstanceProfileTagActions"
950+
effect = "Allow"
951+
resources = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:instance-profile/*"]
952+
actions = ["iam:TagInstanceProfile"]
953+
954+
condition {
955+
test = "StringEquals"
956+
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_config.name}"
957+
values = ["owned"]
958+
}
959+
960+
condition {
961+
test = "StringEquals"
962+
variable = "aws:ResourceTag/topology.kubernetes.io/region"
963+
values = [data.aws_region.current.name]
964+
}
965+
966+
condition {
967+
test = "StringEquals"
968+
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_config.name}"
969+
values = ["owned"]
970+
}
971+
972+
condition {
973+
test = "StringEquals"
974+
variable = "aws:RequestTag/eks:eks-cluster-name"
975+
values = [var.cluster_config.name]
976+
}
977+
978+
condition {
979+
test = "StringEquals"
980+
variable = "aws:RequestTag/topology.kubernetes.io/region"
981+
values = [data.aws_region.current.name]
982+
}
983+
984+
condition {
985+
test = "StringLike"
986+
variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
987+
values = ["*"]
988+
}
989+
990+
condition {
991+
test = "StringLike"
992+
variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
993+
values = ["*"]
994+
}
995+
}
996+
997+
statement {
998+
sid = "AllowScopedInstanceProfileActions"
999+
effect = "Allow"
1000+
resources = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:instance-profile/*"]
1001+
actions = [
1002+
"iam:AddRoleToInstanceProfile",
1003+
"iam:RemoveRoleFromInstanceProfile",
1004+
"iam:DeleteInstanceProfile",
1005+
]
1006+
1007+
condition {
1008+
test = "StringEquals"
1009+
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_config.name}"
1010+
values = ["owned"]
1011+
}
1012+
1013+
condition {
1014+
test = "StringEquals"
1015+
variable = "aws:ResourceTag/topology.kubernetes.io/region"
1016+
values = [data.aws_region.current.name]
1017+
}
1018+
1019+
condition {
1020+
test = "StringLike"
1021+
variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
1022+
values = ["*"]
1023+
}
1024+
}
1025+
1026+
statement {
1027+
sid = "AllowInstanceProfileReadActions"
1028+
effect = "Allow"
1029+
resources = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:instance-profile/*"]
1030+
actions = ["iam:GetInstanceProfile"]
1031+
}
1032+
1033+
statement {
1034+
sid = "AllowAPIServerEndpointDiscovery"
1035+
effect = "Allow"
1036+
resources = [var.cluster_config.arn]
1037+
actions = ["eks:DescribeCluster"]
1038+
}
1039+
}

0 commit comments

Comments
 (0)