Karpenter policy has limited iam:PassRole

[mehraneftekhari99]

• ✋ I have searched the open/closed issues and my issue is not listed.

Please describe your question here

In previous version of blueprints addons, Karpenter policy included a iam:PassRole section that had a wildcard constraint but in V5, it has been changed to only allow aws_iam_role.karpenter[0].arn.

terraform-aws-eks-blueprints-addons/main.tf

Line 2729 in d45aada

karpenter_node_iam_role_arn = try(aws_iam_role.karpenter[0].arn, var.karpenter_node.iam_role_arn, "")

I want to know the rationale of this change, especially since it's not configurable unless creation of IAM resaources is done manually. We bumped into this because after upgrade, nodes couldn't join the cluste and we had to add the PassRole policy section manually to include the ondemand nodes ASG role. (We have one ASG with two nodes, but other nodes are managed by Karpenter)

"error": "creating machine, creating instance, with fleet error(s), UnauthorizedOperation: You are not authorized to perform this operation.

"DecodedMessage": "{\"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{\"items\":[]},\"failures\":{\"items\":[]},\"context\":{\"principal\":{\"id\":\"AROAZREDACTED4376624\",\"arn\":\"arn:aws:sts::REDACTED:assumed-role/karpenter-202310REDACTED00008/1696REDACTED624\"},\"action\":\"iam:PassRole\",\"resource\":\"arn:aws:iam::REDACTED:role/abcd-stg-ondemand\",\"conditions\":{\"items\":[{\"key\":\"aws:Region\",\"values\":{\"items\":[{\"value\":\"eu-central-1\"}]}},{\"key\":\"aws:Service\",\"values\":{\"items\":[{\"value\":\"ec2\"}]}},{\"key\":\"aws:Resource\",\"values\":{\"items\":[{\"value\":\"role/abcd-stg-ondemand\"}]}},{\"key\":\"iam:RoleName\",\"values\":{\"items\":[{\"value\":\"blabs-stg-ondemand\"}]}},{\"key\":\"aws:Type\",\"values\":{\"items\":[{\"value\":\"role\"}]}},{\"key\":\"aws:Account\",\"values\":{\"items\":[{\"value\":\"REDACTED\"}]}},{\"key\":\"aws:ARN\",\"values\":{\"items\":[{\"value\":\"arn:aws:iam::REDACTED:role/abcd-stg-ondemand\"}]}}]}}}"

Please let me know if more information is needed.

[bryantbiggs]

Karpenter should only allow passing the role used by the nodes it creates, which is why this is restricted in this project. There have been a number of changes in the upstream Karpenter project which we are planning to re-align with on the next breaking change. You can track that effort in #286