-
-
Notifications
You must be signed in to change notification settings - Fork 29
/
karpenter.tf
121 lines (98 loc) · 2.86 KB
/
karpenter.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
data "aws_iam_policy" "ssm_managed_instance" {
arn = "arn:${local.partition}:iam::aws:policy/AmazonSSMManagedInstanceCore"
}
module "karpenter" {
count = var.karpenter_enabled ? 1 : 0
source = "terraform-aws-modules/eks/aws//modules/karpenter"
version = "20.31.4"
cluster_name = var.environment_name
enable_irsa = true
irsa_oidc_provider_arn = aws_iam_openid_connect_provider.cluster.arn
irsa_namespace_service_accounts = ["karpenter:karpenter"]
create_iam_role = true
iam_role_name = substr("${var.environment_name}-karpenter-controller", 0, 37)
create_node_iam_role = false
node_iam_role_use_name_prefix = false
node_iam_role_arn = aws_iam_role.node.arn
create_instance_profile = true
create_access_entry = false
queue_name = "${var.environment_name}-spot-termination"
tags = local.tags
}
resource "helm_release" "karpenter" {
count = var.karpenter_enabled ? 1 : 0
namespace = "karpenter"
create_namespace = true
name = "karpenter"
repository = "oci://public.ecr.aws/karpenter"
chart = "karpenter"
version = var.karpenter_version
set {
name = "settings.clusterName"
value = aws_eks_cluster.cluster.name
}
set {
name = "settings.clusterEndpoint"
value = aws_eks_cluster.cluster.endpoint
}
set {
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
value = module.karpenter[0].iam_role_arn
}
depends_on = [
helm_release.karpenter_crd
]
}
resource "helm_release" "karpenter_crd" {
count = var.karpenter_enabled ? 1 : 0
namespace = "karpenter"
create_namespace = true
name = "karpenter-crd"
repository = "oci://public.ecr.aws/karpenter"
chart = "karpenter-crd"
version = var.karpenter_version
}
resource "null_resource" "karpenter_ec2_node_class_apply" {
count = var.karpenter_enabled ? 1 : 0
provisioner "local-exec" {
command = <<EOT
cat <<EOF | kubectl apply -f -
apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
name: default
spec:
metadataOptions:
httpEndpoint: enabled
httpProtocolIPv6: disabled
httpPutResponseHopLimit: 1
httpTokens: optional
blockDeviceMappings:
- deviceName: /dev/xvda
ebs:
volumeSize: 20Gi
volumeType: gp3
encrypted: true
- deviceName: /dev/xvdb
ebs:
volumeSize: 50Gi
volumeType: gp3
encrypted: true
amiFamily: ${var.karpenter_ami_family}
role: ${aws_iam_role.node.name}
securityGroupSelectorTerms:
- id: ${aws_eks_cluster.cluster.vpc_config[0].cluster_security_group_id}
subnetSelectorTerms:
- id: ${aws_subnet.public[0].id}
- id: ${aws_subnet.public[1].id}
amiSelectorTerms:
- alias: bottlerocket@latest
EOF
EOT
}
depends_on = [
aws_eks_cluster.cluster,
helm_release.karpenter_crd,
helm_release.karpenter
]
}