Skip to content

Instantly share code, notes, and snippets.

@bhalothia

bhalothia/karpenter-controller-iam-role.hcl

Created December 28, 2021 02:33
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save bhalothia/bb5a33f6ed2e4299e67c260a018f9c5a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save bhalothia/bb5a33f6ed2e4299e67c260a018f9c5a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. bhalothia renamed this gist Dec 28, 2021. 1 changed file with 0 additions and 0 deletions.
    0 karpenter-controller-iam-role → karpenter-controller-iam-role.hcl
    View file
    File renamed without changes.
  2. bhalothia created this gist Dec 28, 2021.
    39 changes: 39 additions & 0 deletions karpenter-controller-iam-role
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,39 @@
    module "iam_assumable_role_karpenter" {
    source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
    version = "4.7.0"
    create_role = true
    role_name = "karpenter-controller-${var.cluster_name}"
    provider_url = module.eks.cluster_oidc_issuer_url
    oidc_fully_qualified_subjects = ["system:serviceaccount:karpenter:karpenter"]
    }

    resource "aws_iam_role_policy" "karpenter_contoller" {
    name = "karpenter-policy-${var.cluster_name}"
    role = module.iam_assumable_role_karpenter.iam_role_name

    policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
    {
    Action = [
    "ec2:CreateLaunchTemplate",
    "ec2:CreateFleet",
    "ec2:RunInstances",
    "ec2:CreateTags",
    "iam:PassRole",
    "ec2:TerminateInstances",
    "ec2:DescribeLaunchTemplates",
    "ec2:DescribeInstances",
    "ec2:DescribeSecurityGroups",
    "ec2:DescribeSubnets",
    "ec2:DescribeInstanceTypes",
    "ec2:DescribeInstanceTypeOfferings",
    "ec2:DescribeAvailabilityZones",
    "ssm:GetParameter"
    ]
    Effect = "Allow"
    Resource = "*"
    },
    ]
    })
    }