Removed dependency on IAM (#389)

aws · Apr 30, 2021 · 8fefa6b · 8fefa6b
1 parent 5426595
commit 8fefa6b
Show file tree

Hide file tree

Showing 6 changed files with 26 additions and 125 deletions.
diff --git a/docs/aws/README.md b/docs/aws/README.md
@@ -40,22 +40,37 @@ Karpenter relies on [cert-manager](https://github.com/jetstack/cert-manager) for
 sh -c "$(curl -fsSL https://raw.githubusercontent.com/awslabs/karpenter/v0.2.2/hack/quick-install.sh)"
 ```
 
-### Enable IRSA and attach IAM Role to Service Account
-Enables IRSA for your cluster. This command is idempotent, but only needs to be executed once per cluster.
+### Setup IRSA, Karpenter Controller Role, and Karpenter Node Role
 ```bash
+# Enables IRSA for your cluster. This command is idempotent, but only needs to be executed once per cluster.
 eksctl utils associate-iam-oidc-provider \
 --region ${AWS_DEFAULT_REGION} \
 --cluster ${CLUSTER_NAME} \
 --approve
 
+# Setup KarpenterControllerRole
 kubectl patch serviceaccount karpenter -n karpenter --patch "$(cat <<-EOM
 metadata:
   annotations:
     eks.amazonaws.com/role-arn: arn:aws:iam::${AWS_ACCOUNT_ID}:role/KarpenterControllerRole-${CLUSTER_NAME}
 EOM
 )"
 
-kubectl delete pods -n karpenter -l control-plane=karpenter # Restart controller to load credentials
+# Setup KarpenterNodeRole
+kubectl patch configmap aws-auth -n kube-system --patch "$(cat <<-EOM
+data:
+  mapRoles: |
+    - rolearn: arn:aws:iam::${AWS_ACCOUNT_ID}:role/KarpenterNodeRole-${CLUSTER_NAME}
+      username: system:node:{{EC2PrivateDNSName}}
+      groups:
+      - system:bootstrappers
+      - system:nodes
+$(kubectl get configmap -n kube-system aws-auth -ojsonpath='{.data.mapRoles}' | sed 's/^/    /')
+EOM
+)"
+
+# Restart controller to load credentials
+kubectl delete pods -n karpenter -l control-plane=karpenter
 ```
 
 ### (Optional) Enable Verbose Logging

diff --git a/docs/aws/karpenter.cloudformation.yaml b/docs/aws/karpenter.cloudformation.yaml
@@ -58,16 +58,15 @@ Resources:
               - "ec2:DescribeInstanceTypes"
               - "ec2:DescribeInstanceTypeOfferings"
               - "ec2:DescribeAvailabilityZones"
-              - "iam:GetInstanceProfile"
               - "ssm:GetParameter"
   KarpenterNodeInstanceProfile:
     Type: "AWS::IAM::InstanceProfile"
     Properties:
       InstanceProfileName: !Sub "KarpenterNodeInstanceProfile-${ClusterName}"
       Path: "/"
       Roles:
-        - Ref: "KarpenterNodeInstanceRole"
-  KarpenterNodeInstanceRole:
+        - Ref: "KarpenterNodeRole"
+  KarpenterNodeRole:
     Type: "AWS::IAM::Role"
     Properties:
       RoleName: !Sub "KarpenterNodeRole-${ClusterName}"

diff --git a/pkg/cloudprovider/aws/factory.go b/pkg/cloudprovider/aws/factory.go
@@ -22,7 +22,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws/request"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/awslabs/karpenter/pkg/apis/provisioning/v1alpha1"
 	"github.com/awslabs/karpenter/pkg/cloudprovider"
@@ -60,11 +59,6 @@ func NewFactory(options cloudprovider.Options) *Factory {
 	launchTemplateProvider := &LaunchTemplateProvider{
 		ec2api: ec2api,
 		cache:  cache.New(CacheTTL, CacheCleanupInterval),
-		instanceProfileProvider: &InstanceProfileProvider{
-			iamapi:     iam.New(sess),
-			kubeClient: options.Client,
-			cache:      cache.New(CacheTTL, CacheCleanupInterval),
-		},
 		securityGroupProvider: &SecurityGroupProvider{
 			ec2api: ec2api,
 			cache:  cache.New(CacheTTL, CacheCleanupInterval),

diff --git a/pkg/cloudprovider/aws/instanceprofile.go b/pkg/cloudprovider/aws/instanceprofile.go
diff --git a/pkg/cloudprovider/aws/launchtemplate.go b/pkg/cloudprovider/aws/launchtemplate.go
@@ -49,12 +49,11 @@ cluster-name = "{{.Name}}"
 )
 
 type LaunchTemplateProvider struct {
-	ec2api                  ec2iface.EC2API
-	cache                   *cache.Cache
-	instanceProfileProvider *InstanceProfileProvider
-	securityGroupProvider   *SecurityGroupProvider
-	ssm                     ssmiface.SSMAPI
-	clientSet               *kubernetes.Clientset
+	ec2api                ec2iface.EC2API
+	cache                 *cache.Cache
+	securityGroupProvider *SecurityGroupProvider
+	ssm                   ssmiface.SSMAPI
+	clientSet             *kubernetes.Clientset
 }
 
 func launchTemplateName(clusterName string, arch string) string {
@@ -113,10 +112,6 @@ func (p *LaunchTemplateProvider) createLaunchTemplate(ctx context.Context, clust
 	if err != nil {
 		return nil, fmt.Errorf("getting security groups, %w", err)
 	}
-	instanceProfile, err := p.instanceProfileProvider.Get(ctx, cluster)
-	if err != nil {
-		return nil, fmt.Errorf("getting instance profile, %w", err)
-	}
 	amiID, err := p.getAMIID(ctx, arch)
 	if err != nil {
 		return nil, fmt.Errorf("getting AMI ID, %w", err)
@@ -131,7 +126,7 @@ func (p *LaunchTemplateProvider) createLaunchTemplate(ctx context.Context, clust
 		LaunchTemplateName: aws.String(launchTemplateName(cluster.Name, arch)),
 		LaunchTemplateData: &ec2.RequestLaunchTemplateData{
 			IamInstanceProfile: &ec2.LaunchTemplateIamInstanceProfileSpecificationRequest{
-				Name: instanceProfile.InstanceProfileName,
+				Name: aws.String(fmt.Sprintf("KarpenterNodeInstanceProfile-%s", cluster.Name)),
 			},
 			TagSpecifications: []*ec2.LaunchTemplateTagSpecificationRequest{{
 				ResourceType: aws.String(ec2.ResourceTypeInstance),

diff --git a/pkg/cloudprovider/aws/suite_test.go b/pkg/cloudprovider/aws/suite_test.go
@@ -63,11 +63,6 @@ var env = test.NewEnvironment(func(e *test.Environment) {
 	launchTemplateProvider := &LaunchTemplateProvider{
 		ec2api: fakeEC2API,
 		cache:  launchTemplateCache,
-		instanceProfileProvider: &InstanceProfileProvider{
-			iamapi:     &fake.IAMAPI{},
-			kubeClient: e.Manager.GetClient(),
-			cache:      instanceProfileCache,
-		},
 		securityGroupProvider: &SecurityGroupProvider{
 			ec2api: fakeEC2API,
 			cache:  securityGroupCache,