diff --git a/modules/karpenter/README.md b/modules/karpenter/README.md index ad8dfcd979..f283b6e741 100644 --- a/modules/karpenter/README.md +++ b/modules/karpenter/README.md @@ -110,6 +110,7 @@ No modules. | [aws_iam_policy.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_role.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy_attachment.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.controller_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | @@ -139,6 +140,7 @@ No modules. | [create\_instance\_profile](#input\_create\_instance\_profile) | Whether to create an IAM instance profile | `bool` | `false` | no | | [create\_node\_iam\_role](#input\_create\_node\_iam\_role) | Determines whether an IAM role is created or to use an existing IAM role | `bool` | `true` | no | | [create\_pod\_identity\_association](#input\_create\_pod\_identity\_association) | Determines whether to create pod identity association | `bool` | `true` | no | +| [enable\_inline\_policy](#input\_enable\_inline\_policy) | Determines whether the controller policy is created as a standard IAM policy or inline IAM policy. This can be enabled when the error `LimitExceeded: Cannot exceed quota for PolicySize: 6144` is received since standard IAM policies have a limit of 6,144 characters versus an inline role policy's limit of 10,240 ([Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html)) | `bool` | `false` | no | | [enable\_spot\_termination](#input\_enable\_spot\_termination) | Determines whether to enable native spot termination handling | `bool` | `true` | no | | [iam\_policy\_description](#input\_iam\_policy\_description) | IAM policy description | `string` | `"Karpenter controller IAM policy"` | no | | [iam\_policy\_name](#input\_iam\_policy\_name) | Name of the IAM policy | `string` | `"KarpenterController"` | no | diff --git a/modules/karpenter/main.tf b/modules/karpenter/main.tf index 4d3cc08ed1..af0e947e76 100644 --- a/modules/karpenter/main.tf +++ b/modules/karpenter/main.tf @@ -70,8 +70,17 @@ resource "aws_iam_role" "controller" { tags = merge(var.tags, var.iam_role_tags) } +resource "aws_iam_role_policy" "controller" { + count = local.create_iam_role && var.enable_inline_policy ? 1 : 0 + + name = var.iam_policy_use_name_prefix ? null : var.iam_policy_name + name_prefix = var.iam_policy_use_name_prefix ? "${var.iam_policy_name}-" : null + role = aws_iam_role.controller[0].name + policy = data.aws_iam_policy_document.controller[0].json +} + resource "aws_iam_policy" "controller" { - count = local.create_iam_role ? 1 : 0 + count = local.create_iam_role && !var.enable_inline_policy ? 1 : 0 name = var.iam_policy_use_name_prefix ? null : var.iam_policy_name name_prefix = var.iam_policy_use_name_prefix ? "${var.iam_policy_name}-" : null @@ -83,7 +92,7 @@ resource "aws_iam_policy" "controller" { } resource "aws_iam_role_policy_attachment" "controller" { - count = local.create_iam_role ? 1 : 0 + count = local.create_iam_role && !var.enable_inline_policy ? 1 : 0 role = aws_iam_role.controller[0].name policy_arn = aws_iam_policy.controller[0].arn diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf index 6d3d042516..b814963485 100644 --- a/modules/karpenter/variables.tf +++ b/modules/karpenter/variables.tf @@ -32,6 +32,12 @@ variable "create_iam_role" { default = true } +variable "enable_inline_policy" { + description = "Determines whether the controller policy is created as a standard IAM policy or inline IAM policy. This can be enabled when the error `LimitExceeded: Cannot exceed quota for PolicySize: 6144` is received since standard IAM policies have a limit of 6,144 characters versus an inline role policy's limit of 10,240 ([Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html))" + type = bool + default = false +} + variable "iam_role_name" { description = "Name of the IAM role" type = string