added spot instance policy for service-lined-role

squareops · Jul 23, 2024 · 42afbd2 · 42afbd2
1 parent d986693
commit 42afbd2
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 2 deletions.
diff --git a/examples/complete/main.tf b/examples/complete/main.tf
@@ -81,4 +81,4 @@ module "eks-addons" {
  velero_backup_name = "application-backup"
  backup_bucket_name = "velero-bucket"
  }
-}
+}
diff --git a/modules/kubernetes-addons/karpenter/data.tf b/modules/kubernetes-addons/karpenter/data.tf
@@ -38,3 +38,19 @@ data "aws_iam_policy_document" "karpenter" {
  }
  }
 }
+
+data "aws_iam_policy_document" "karpenter-spot-service-linked-policy" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "iam:CreateServiceLinkedRole"
+ ]
+ resources = ["*"]
+
+ condition {
+ test = "StringEquals"
+ variable = "iam:AWSServiceName"
+ values = ["spot.amazonaws.com"]
+ }
+ }
+}
diff --git a/modules/kubernetes-addons/karpenter/locals.tf b/modules/kubernetes-addons/karpenter/locals.tf
@@ -37,7 +37,7 @@ locals {
  kubernetes_service_account = local.service_account
  create_kubernetes_namespace = try(local.helm_config["create_namespace"], true)
  create_kubernetes_service_account = true
- irsa_iam_policies = concat([aws_iam_policy.karpenter.arn], var.irsa_policies)
+ irsa_iam_policies = concat([aws_iam_policy.karpenter.arn , aws_iam_policy.karpenter-spot.arn], var.irsa_policies)
  }
 
  argocd_gitops_config = {

diff --git a/modules/kubernetes-addons/karpenter/main.tf b/modules/kubernetes-addons/karpenter/main.tf
@@ -12,3 +12,9 @@ resource "aws_iam_policy" "karpenter" {
  description = "IAM Policy for Karpenter"
  policy = data.aws_iam_policy_document.karpenter.json
 }
+
+resource "aws_iam_policy" "karpenter-spot" {
+ name = "${var.addon_context.eks_cluster_id}-karpenter-spot"
+ description = "IAM Policy for Karpenter"
+ policy = data.aws_iam_policy_document.karpenter-spot-service-linked-policy.json
+}