diff --git a/modules/karpenter/README.md b/modules/karpenter/README.md index 89f5495f33..e1c1abd92a 100644 --- a/modules/karpenter/README.md +++ b/modules/karpenter/README.md @@ -168,6 +168,7 @@ No modules. | [irsa\_ssm\_parameter\_arns](#input\_irsa\_ssm\_parameter\_arns) | List of SSM Parameter ARNs that contain AMI IDs launched by Karpenter | `list(string)` |
[| no | | [irsa\_subnet\_account\_id](#input\_irsa\_subnet\_account\_id) | Account ID of where the subnets Karpenter will utilize resides. Used when subnets are shared from another account | `string` | `""` | no | | [irsa\_tag\_key](#input\_irsa\_tag\_key) | Tag key (`{key = value}`) applied to resources launched by Karpenter through the Karpenter provisioner | `string` | `"karpenter.sh/discovery"` | no | +| [irsa\_tag\_values](#input\_irsa\_tag\_values) | Tag values (`{key = value}`) applied to resources launched by Karpenter through the Karpenter provisioner. Defaults to cluster name when not set. | `list(string)` | `null` | no | | [irsa\_tags](#input\_irsa\_tags) | A map of additional tags to add the the IAM role for service accounts | `map(any)` | `{}` | no | | [irsa\_use\_name\_prefix](#input\_irsa\_use\_name\_prefix) | Determines whether the IAM role for service accounts name (`irsa_name`) is used as a prefix | `bool` | `true` | no | | [policies](#input\_policies) | Policies to attach to the IAM role in `{'static_name' = 'policy_arn'}` format | `map(string)` | `{}` | no | diff --git a/modules/karpenter/main.tf b/modules/karpenter/main.tf index fdae1a410a..2c809ed621 100644 --- a/modules/karpenter/main.tf +++ b/modules/karpenter/main.tf @@ -63,6 +63,10 @@ resource "aws_iam_role" "irsa" { tags = merge(var.tags, var.irsa_tags) } +locals { + irsa_tag_values = coalescelist([var.cluster_name], var.irsa_tag_values) +} + data "aws_iam_policy_document" "irsa" { count = local.create_irsa ? 1 : 0 @@ -97,7 +101,7 @@ data "aws_iam_policy_document" "irsa" { condition { test = "StringEquals" variable = "ec2:ResourceTag/${var.irsa_tag_key}" - values = [var.cluster_name] + values = local.irsa_tag_values } } @@ -110,7 +114,7 @@ data "aws_iam_policy_document" "irsa" { condition { test = "StringEquals" variable = "ec2:ResourceTag/${var.irsa_tag_key}" - values = [var.cluster_name] + values = local.irsa_tag_values } } diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf index f92160f2d4..47c42bace9 100644 --- a/modules/karpenter/variables.tf +++ b/modules/karpenter/variables.tf @@ -86,6 +86,12 @@ variable "irsa_tag_key" { default = "karpenter.sh/discovery" } +variable "irsa_tag_values" { + description = "Tag values (`{key = value}`) applied to resources launched by Karpenter through the Karpenter provisioner. Defaults to cluster name when not set." + type = list(string) + default = null +} + variable "irsa_ssm_parameter_arns" { description = "List of SSM Parameter ARNs that contain AMI IDs launched by Karpenter" type = list(string)
"arn:aws:ssm:*:*:parameter/aws/service/*"
]