Implemented cloud provider initialization #208
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,33 +14,54 @@ This command will create an IAM Policy with access to all of the resources for a | |
| ``` | ||
| aws iam create-policy --policy-name Karpenter --policy-document "$(cat <<-EOM | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Action": [ | ||
| "eks:DescribeNodegroup", | ||
| "eks:UpdateNodegroupConfig" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Action": [ | ||
| "autoscaling:DescribeAutoScalingGroups", | ||
| "autoscaling:UpdateAutoScalingGroup" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Action": [ | ||
| "sqs:GetQueueAttributes", | ||
| "sqs:GetQueueUrl" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Action": [ | ||
| "ec2:DescribeLaunchTemplates", | ||
| "ec2:CreateLaunchTemplate", | ||
| "ec2:CreateFleet", | ||
| "ec2:RunInstances", | ||
| "ec2:DescribeInstances", | ||
| "ec2:CreateTags", | ||
| "ec2:DescribeSubnets", | ||
| "eks:DescribeCluster", | ||
| "iam:GetRole", | ||
| "iam:CreateRole", | ||
|
There was a problem hiding this comment. I think this is a scary permission. I think it would be better to accept a pre-created role ARN as a parameter somewhere, and don't create the Instance Role ourselves. (Probably similar with some of the other permissions too, but this one jumps out immediately.) There was a problem hiding this comment. Yeah i was thinking about this. Here's how I was thinking about it: There was a problem hiding this comment. IMO, if this is for demo purposes we should move it to karpenter-aws-demo There was a problem hiding this comment. I agree with you here. Let's add this to the list of design considerations. In the short term, I have some changes here. There was a problem hiding this comment. Yeah, 'demo' features have a tendency to leak out and become the 'default' install. This one in particular seems like it's worth some effort to think about how we avoid it - even if the install instructions turn out to be two commands instead of one. |
||
| "iam:AddRoleToInstanceProfile", | ||
| "iam:PassRole", | ||
| "iam:GetInstanceProfile", | ||
| "iam:CreateInstanceProfile", | ||
| "iam:AttachRolePolicy" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "*" | ||
| } | ||
| ] | ||
| } | ||
| EOM | ||
| )" | ||
|
|
@@ -73,7 +94,17 @@ kubectl delete pods -n karpenter -l control-plane=karpenter | |
| ``` | ||
|
|
||
| ### Cleanup | ||
| ```bash | ||
| eksctl delete iamserviceaccount --cluster ${CLUSTER_NAME} --name default --namespace karpenter | ||
| aws iam delete-policy --policy-arn arn:aws:iam::${AWS_ACCOUNT_ID}:policy/Karpenter | ||
|
|
||
| # Remove Karpenter generated resources | ||
| aws iam remove-role-from-instance-profile --instance-profile-name KarpenterNodeRole --role-name KarpenterNodeRole | ||
| aws iam delete-instance-profile --instance-profile-name KarpenterNodeRole | ||
| aws iam detach-role-policy --role-name KarpenterNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore | ||
| aws iam detach-role-policy --role-name KarpenterNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy | ||
| aws iam detach-role-policy --role-name KarpenterNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy | ||
| aws iam detach-role-policy --role-name KarpenterNodeRole --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly | ||
| aws iam delete-role --role-name KarpenterNodeRole | ||
| aws ec2 describe-launch-templates | jq -r ".LaunchTemplates[].LaunchTemplateName" | grep KarpenterLaunchTemplate | xargs -I{} aws ec2 delete-launch-template --launch-template-name {} | ||
| ``` | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we add
createto nodes and pods resources earlier in the file on line # 60-61There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I had originally not wanted to allow create pods, but the more I think about it, we probably want to do this for sharding.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wait nevermind, we'd want create deployment, or something. Leaving as is.