diff --git a/README.md b/README.md index 5a074b966d..ee5cf25c61 100644 --- a/README.md +++ b/README.md @@ -289,6 +289,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple | [fargate\_profiles](#input\_fargate\_profiles) | Map of Fargate Profile definitions to create | `any` | `{}` | no | | [iam\_role\_additional\_policies](#input\_iam\_role\_additional\_policies) | Additional policies to be added to the IAM role | `map(string)` | `{}` | no | | [iam\_role\_arn](#input\_iam\_role\_arn) | Existing IAM role ARN for the cluster. Required if `create_iam_role` is set to `false` | `string` | `null` | no | +| [iam\_role\_conditions](#input\_iam\_role\_conditions) | Additional conditions of the IAM role assume policy |
list(object({
test = string
variable = string
values = list(string)
})) | `[]` | no |
| [iam\_role\_description](#input\_iam\_role\_description) | Description of the role | `string` | `null` | no |
| [iam\_role\_name](#input\_iam\_role\_name) | Name to use on IAM role created | `string` | `null` | no |
| [iam\_role\_path](#input\_iam\_role\_path) | Cluster IAM role path | `string` | `null` | no |
diff --git a/main.tf b/main.tf
index 037de7b5d8..7d09acf43a 100644
--- a/main.tf
+++ b/main.tf
@@ -404,6 +404,15 @@ data "aws_iam_policy_document" "assume_role_policy" {
]
}
}
+
+ dynamic "condition" {
+ for_each = var.iam_role_conditions
+ content {
+ test = condition.value.test
+ variable = condition.value.variable
+ values = condition.value.values
+ }
+ }
}
}
diff --git a/modules/karpenter/README.md b/modules/karpenter/README.md
index ef2be2099c..5b2deff1dd 100644
--- a/modules/karpenter/README.md
+++ b/modules/karpenter/README.md
@@ -149,6 +149,7 @@ No modules.
| [iam\_policy\_path](#input\_iam\_policy\_path) | Path of the IAM policy | `string` | `"/"` | no |
| [iam\_policy\_statements](#input\_iam\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed | `any` | `[]` | no |
| [iam\_policy\_use\_name\_prefix](#input\_iam\_policy\_use\_name\_prefix) | Determines whether the name of the IAM policy (`iam_policy_name`) is used as a prefix | `bool` | `true` | no |
+| [iam\_role\_conditions](#input\_iam\_role\_conditions) | Additional conditions of the IAM role assume policy | list(object({
test = string
variable = string
values = list(string)
})) | `[]` | no |
| [iam\_role\_description](#input\_iam\_role\_description) | IAM role description | `string` | `"Karpenter controller IAM role"` | no |
| [iam\_role\_max\_session\_duration](#input\_iam\_role\_max\_session\_duration) | Maximum API session duration in seconds between 3600 and 43200 | `number` | `null` | no |
| [iam\_role\_name](#input\_iam\_role\_name) | Name of the IAM role | `string` | `"KarpenterController"` | no |
diff --git a/modules/karpenter/main.tf b/modules/karpenter/main.tf
index d03dfa49f8..1fff52367d 100644
--- a/modules/karpenter/main.tf
+++ b/modules/karpenter/main.tf
@@ -289,6 +289,15 @@ data "aws_iam_policy_document" "node_assume_role" {
type = "Service"
identifiers = ["ec2.${local.dns_suffix}"]
}
+
+ dynamic "condition" {
+ for_each = var.iam_role_conditions
+ content {
+ test = condition.value.test
+ variable = condition.value.variable
+ values = condition.value.values
+ }
+ }
}
}
diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf
index a2c307fc05..28a8579d04 100644
--- a/modules/karpenter/variables.tf
+++ b/modules/karpenter/variables.tf
@@ -62,6 +62,16 @@ variable "iam_role_permissions_boundary_arn" {
default = null
}
+variable "iam_role_conditions" {
+ description = "Additional conditions of the IAM role assume policy"
+ type = list(object({
+ test = string
+ variable = string
+ values = list(string)
+ }))
+ default = []
+}
+
variable "iam_role_tags" {
description = "A map of additional tags to add the the IAM role"
type = map(any)
diff --git a/variables.tf b/variables.tf
index 7a7226b96a..dc85543ef8 100644
--- a/variables.tf
+++ b/variables.tf
@@ -474,6 +474,16 @@ variable "iam_role_permissions_boundary" {
default = null
}
+variable "iam_role_conditions" {
+ description = "Additional conditions of the IAM role assume policy"
+ type = list(object({
+ test = string
+ variable = string
+ values = list(string)
+ }))
+ default = []
+}
+
variable "iam_role_additional_policies" {
description = "Additional policies to be added to the IAM role"
type = map(string)