karpenter: `iam:PassedToService` has to be `ec2.amazonaws.com.cn` in AWS China

fanyang01 commented 1 month ago

Description

I got the following error from Karpenter's logs when creating a new pod on an EKS cluster freshly created in the cn-northwest-1 region with Karpenter installed:

launching nodeclaim, creating instance, with fleet error(s), UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws-cn:sts::xxxxx:assumed-role/xxxx-karpenter-controller-role/xxxxx is not authorized to perform: iam:PassRole on resource: arn:aws-cn:iam::xxxx:role/xxxxx-karpenter-node-role because no identity-based policy allows the iam:PassRole action.

The root cause appears to be the following code:

https://github.com/terraform-aws-modules/terraform-aws-eks/blob/a7ff103478c40e0e1e58b151444e9e91ab0be07a/modules/karpenter/main.tf#L269-L280

I have manually changed ec2.amazonaws.com to ec2.amazonaws.com.cn in the policy document attached to the controller role. Then the pod can be scheduled successfully by Karpenter and the error disappears.

[x] ✋ I have searched the open/closed issues and my issue is not listed.

Versions

Module version [Required]: 20.13
Terraform version:
```
Terraform v1.3.9
on darwin_arm64
```
provider registry.terraform.io/alekc/kubectl v2.0.4
provider registry.terraform.io/hashicorp/aws v5.52.0
provider registry.terraform.io/hashicorp/cloudinit v2.3.4
provider registry.terraform.io/hashicorp/helm v2.13.2
provider registry.terraform.io/hashicorp/kubernetes v2.30.0
provider registry.terraform.io/hashicorp/null v3.2.2
provider registry.terraform.io/hashicorp/time v0.11.2
provider registry.terraform.io/hashicorp/tls v4.0.5

Reproduction Code [Required]

module "karpenter" {
  source  = "terraform-aws-modules/eks/aws//modules/karpenter"
  version = "~> 20.13"

  cluster_name = module.eks.cluster_name

  iam_role_name              = "${local.cluster_name}-karpenter-controller-role"
  iam_policy_name            = "${local.cluster_name}-karpenter-controller-policy"
  iam_role_use_name_prefix   = false
  iam_policy_use_name_prefix = false

  node_iam_role_name            = "${local.cluster_name}-karpenter-node-role"
  node_iam_role_use_name_prefix = false

  enable_spot_termination = true
  enable_pod_identity     = true

  tags = local.tags
}

Actual behavior

Karpenter failed to provision EC2 nodes for a pending pod.

github-actions[bot] commented 1 week ago

This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days

github-actions[bot] commented 3 days ago

This issue was automatically closed because of stale in 10 days

terraform-aws-modules / terraform-aws-eks