Skip to content

feat: Update Karpenter sub-module to support Karpenter v1.12#3690

Merged
bryantbiggs merged 3 commits intoterraform-aws-modules:masterfrom
ChristianRothQC:feat/karpenter-v1.12-policy-updates
Apr 27, 2026
Merged

feat: Update Karpenter sub-module to support Karpenter v1.12#3690
bryantbiggs merged 3 commits intoterraform-aws-modules:masterfrom
ChristianRothQC:feat/karpenter-v1.12-policy-updates

Conversation

@ChristianRothQC
Copy link
Copy Markdown
Contributor

@ChristianRothQC ChristianRothQC commented Apr 27, 2026

Description

This PR updates the Karpenter module to support Karpenter v1.12.

  1. Add ec2:DescribeInstanceStatus to the controller IAM policy (required for EC2 instance status health checks in the interruption controller)
  2. Add arc-zonal-shift:GetManagedResource permission scoped to the EKS cluster ARN (supports ARC Zonal Shift)
  3. Update Karpenter example to demonstrate zonal shift Helm configuration

Motivation and Context

Karpenter v1.12.0 introduces two IAM-relevant changes per the upgrade guide:

Upgrading to 1.12.0

This version of Karpenter adds an additional IAM permission, ec2:DescribeInstanceStatus, for EC2 instance status health checks in the interruption controller. [...]

This version also adds support for AWS Application Recovery Controller Zonal Shift. This capability is opt-in, disabled by default. You'll need to provision a new IAM permission, arc-zonal-shift:GetManagedResource [...] See the Zonal Shift Onboarding section of the Getting Started Guide for instructions on enabling zonal shift on new or existing clusters.

Both permissions are included unconditionally — the module provides full IAM permissions and users enable/disable features via the Karpenter controller's Helm values (settings.enableZonalShift). The arc-zonal-shift:GetManagedResource resource ARN is scoped to the specific EKS cluster, matching upstream's CloudFormation template.

Breaking Changes

None. Both permissions are additive.

How Has This Been Tested?

  • I have updated at least one of the examples/* to demonstrate and validate my change(s)
  • I have tested and validated these changes using one or more of the examples/*

🤖 Generated with Claude Code

Comment thread modules/karpenter/policy.tf Outdated
actions = ["pricing:GetProducts"]
}

dynamic "statement" {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove the feature gating - we will default to full permissions, and its up to users to enable/disable on the controllers values file

…ionally

Per maintainer feedback, the module should default to full permissions
and let users enable/disable features via the controller's Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@bryantbiggs bryantbiggs merged commit 3bc989b into terraform-aws-modules:master Apr 27, 2026
23 checks passed
antonbabenko pushed a commit that referenced this pull request Apr 27, 2026
## [21.19.0](v21.18.0...v21.19.0) (2026-04-27)

### Features

* Update Karpenter sub-module to support Karpenter `v1.12` ([#3690](#3690)) ([3bc989b](3bc989b))
@antoine-labarussias-wmx
Copy link
Copy Markdown
Contributor

@ChristianRothQC It seems arc-zonal-shift:GetManagedResource does not yet support eks clusters arns. I am receiving an access denied message with your policy

https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapplicationrecoverycontroller-zonalshift.html

@ChristianRothQC
Copy link
Copy Markdown
Contributor Author

@antoine-labarussias-wmx - urgh - I am very sorry for this - I should've checked this carefully :/

@bryantbiggs
Copy link
Copy Markdown
Member

if this does not work then it should be opened on the Karpenter repository - we match upstream's guidance

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants