feat: Add irsa_tag_values variable

[tongueroo]

Description

Describe your changes in detail

Add irsa_tag_values variable for more control over the generated IAM policy.

Motivation and Context

Why is this change required? What problem does it solve?

This allows karpenter to be used in a setup where the EKS cluster and VPC subnets do not have matching karpenter.sh/discovery tags. An example is using an existing VPC and launching multiple EKS clusters for testing with the same VPC.

Currently, the KarpenterIRSA-* IAM role creates an IAM policy that contains a IAM permission that restricts ec2:RunInstances, ec2:TerminateInstances, ec2:DeleteLaunchTemplates to restrict based on karpenter.sh/discovery": "${CLUSTER_NAME}", something like this:

        {
            "Action": [
                "ec2:TerminateInstances",
                "ec2:DeleteLaunchTemplate"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/karpenter.sh/discovery": "${CLUSTER_NAME}"
                }
            },
            "Effect": "Allow",
            "Resource": "*",
            "Sid": ""
        },
        {
            "Action": "ec2:RunInstances",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/karpenter.sh/discovery": "${CLUSTER_NAME}"
                }
            },
            "Effect": "Allow",
            "Resource": "arn:aws:ec2:*:11111111111:launch-template/*",
            "Sid": ""
        },

Source:

terraform-aws-eks/modules/karpenter/main.tf

Lines 89 to 115 in 0f9d9fa

	statement {
	actions = [
	"ec2:TerminateInstances",
	"ec2:DeleteLaunchTemplate",
	]
	resources = ["*"]
	condition {
	test = "StringEquals"
	variable = "ec2:ResourceTag/${var.irsa_tag_key}"
	values = [var.cluster_name]
	}
	}
	statement {
	actions = ["ec2:RunInstances"]
	resources = [
	"arn:${local.partition}:ec2:*:${local.account_id}:launch-template/*",
	]
	condition {
	test = "StringEquals"
	variable = "ec2:ResourceTag/${var.irsa_tag_key}"
	values = [var.cluster_name]
	}
	}

So we cannot use an existing VPC with an existing subnet tag. IE: We cannot use VPC with subnet tags karpenter.sh/discovery=my-subnet-tag with multiple EKS clusters. Karpenter isn't permitted to successfully launch new nodes, due to the IAM permission assumption.

If it fixes an open issue, please link to the issue here.

Searched and did not find related issues.

Breaking Changes

Does this break backwards compatibility with the current major version?

Nope

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects

Ran the examples/karpenter and confirmed it works as a regression test.

Please describe how you tested your changes

Tested with an existing VPC with existing subnet tags, deployed EKS cluster, and deployed karpenter. Something like this:

module "karpenter" {
  source = "/path/to/modules/eks/modules/karpenter"

  cluster_name           = module.eks.cluster_name
  irsa_oidc_provider_arn = module.eks.oidc_provider_arn

  # Set new variable
  irsa_tag_values = ["my-subnet-tag"]
}

Scaled up a deployment to trigger Karpenter to add nodes. Confirmed that the nodes register successfully.

• I have executed pre-commit run -a on my pull request

Click to see pre-commit run -a results:

$ pre-commit run -a
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
check for merge conflicts................................................Passed
fix end of files.........................................................Passed

[antonbabenko]

This PR is included in version 19.14.0 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.