upgrade karpenter

Signed-off-by: Mahmoud Gaballah <[email protected]>

Author: myaser

cluster/cluster.yaml

@@ -570,12 +570,12 @@ Resources:
               - 'sts:AssumeRoleWithWebIdentity'
             Condition:
               StringEquals:
-                "{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:aud": "sts.amazonaws.com",
-                "{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:sub": "system:serviceaccount:kube-system:karpenter",
+                "{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:aud": "sts.amazonaws.com"
+                "{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:sub": "system:serviceaccount:kube-system:karpenter"
         Version: 2012-10-17
       Path: /
       Policies:
-        - ManagedPolicyName: !Sub "KarpenterControllerPolicy-{{.Cluster.ID}}"
+        - PolicyName: "KarpenterControllerPolicy-{{ .Cluster.ID | awsValidID }}"
           # The PolicyDocument must be in JSON string format because we use a StringEquals condition that uses an interpolated
           # value in one of its key parameters which isn't natively supported by CloudFormation
           PolicyDocument: !Sub |
@@ -734,7 +734,7 @@ Resources:
                 {
                   "Sid": "AllowPassingInstanceRole",
                   "Effect": "Allow",
-                  "Resource": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/KarpenterNodeRole-{{.Cluster.ID}}",
+                  "Resource": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/{{.Cluster.LocalID}}-worker",
                   "Action": "iam:PassRole",
                   "Condition": {
                     "StringEquals": {
@@ -803,7 +803,7 @@ Resources:
                   "Effect": "Allow",
                   "Resource": "*",
                   "Action": "iam:GetInstanceProfile"
-                },
+                }
               ]
             }
       RoleName: "{{.Cluster.LocalID}}-app-karpenter"

cluster/manifests/deletions.yaml

@@ -164,14 +164,50 @@ post_apply:
   namespace: kubenurse
   kind: Service
 {{- end }}
-
 - name: karpenter-logging-config
   kind: ConfigMap
   namespace: kube-system
+- name: karpenter-webhook
+  kind: ClusterRole
+- name: karpenter-webhook
+  kind: ClusterRoleBinding
+- name: karpenter-webhook
+  kind: ClusterRole
+- name: karpenter-webhook
+  kind: ClusterRoleBinding
+- name: provisioners.karpenter.sh
+  kind: CustomResourceDefinition
+- name: awsnodetemplates.karpenter.k8s.aws
+  kind: CustomResourceDefinition
+- name: machines.karpenter.sh
+  kind: CustomResourceDefinition
+- name: karpenter-global-settings
+  kind: ConfigMap
+  namespace: kube-system
+- name: config-logging
+  kind: ConfigMap
+  namespace: kube-system
+- name: karpenter-cert
+  kind: Secret
+  namespace: kube-system
+- name: defaulting.webhook.karpenter.k8s.aws
+  kind: MutatingWebhookConfiguration
+- name: validation.webhook.karpenter.k8s.aws
+  kind: ValidatingWebhookConfiguration
+- name: validation.webhook.config.karpenter.sh
+  kind: ValidatingWebhookConfiguration
+- name: validation.webhook.karpenter.sh
+  kind: ValidatingWebhookConfiguration
 {{ if eq .Cluster.ConfigItems.karpenter_pools_enabled "false" }}
 - name: karpenter
   namespace: kube-system
   kind: Deployment
+- name: nodepools.karpenter.sh
+  kind: CustomResourceDefinition
+- name: ec2nodeclasses.karpenter.k8s.aws
+  kind: CustomResourceDefinition
+- name: nodeclaims.karpenter.sh
+  kind: CustomResourceDefinition
 - name: karpenter
   namespace: kube-system
   kind: PodDisruptionBudget
@@ -184,48 +220,31 @@ post_apply:
   kind: ClusterRole
 - name: karpenter-core
   kind: ClusterRoleBinding
-- name: karpenter-webhook
+- name: karpenter
   kind: ClusterRole
-- name: karpenter-webhook
+- name : karpenter
   kind: ClusterRoleBinding
 - name: karpenter
   namespace: kube-system
   kind: Role
 - name: karpenter-dns
   namespace: kube-system
   kind: Role
+- name: karpenter-lease
+  namespace: kube-system
+  kind: Role
 - name: karpenter
   namespace: kube-system
   kind: RoleBinding
 - name: karpenter-dns
   namespace: kube-system
   kind: RoleBinding
+- name: karpenter-lease
+  namespace: kube-system
+  kind: RoleBinding
 - name: karpenter
   namespace: kube-system
   kind: Service
-- name: provisioners.karpenter.sh
-  kind: CustomResourceDefinition
-- name: awsnodetemplates.karpenter.k8s.aws
-  kind: CustomResourceDefinition
-- name: machines.karpenter.sh
-  kind: CustomResourceDefinition
-- name: karpenter-global-settings
-  kind: ConfigMap
-  namespace: kube-system
-- name: config-logging
-  kind: ConfigMap
-  namespace: kube-system
-- name: karpenter-cert
-  kind: Secret
-  namespace: kube-system
-- name: defaulting.webhook.karpenter.k8s.aws
-  kind: MutatingWebhookConfiguration
-- name: validation.webhook.karpenter.k8s.aws
-  kind: ValidatingWebhookConfiguration
-- name: validation.webhook.config.karpenter.sh
-  kind: ValidatingWebhookConfiguration
-- name: validation.webhook.karpenter.sh
-  kind: ValidatingWebhookConfiguration
 - name: karpenter-vpa
   namespace: kube-system
   kind: VerticalPodAutoscaler