> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/terraform-aws-modules/terraform-aws-eks/llms.txt
> Use this file to discover all available pages before exploring further.

# Karpenter

> Input variables and outputs for the karpenter sub-module.

The `karpenter` sub-module creates supporting AWS resources for [Karpenter](https://karpenter.sh), the open-source Kubernetes node autoscaler. This includes the controller IAM role, node IAM role, SQS queue for spot termination handling, and EventBridge rules.

## Inputs

### General

<ParamField name="create" type="bool" default="true">
  Controls if resources should be created (affects nearly all resources).
</ParamField>

<ParamField name="tags" type="map(string)" default="{}">
  A map of tags to add to all resources.
</ParamField>

<ParamField name="cluster_name" type="string" default="">
  The name of the EKS cluster.
</ParamField>

<ParamField name="region" type="string" default="null">
  Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration.
</ParamField>

### Controller IAM Role

<ParamField name="create_iam_role" type="bool" default="true">
  Determines whether an IAM role is created.
</ParamField>

<ParamField name="enable_inline_policy" type="bool" default="false">
  Determines whether the controller policy is created as a standard IAM policy or inline IAM policy. This can be enabled when the error `LimitExceeded: Cannot exceed quota for PolicySize: 6144` is received since standard IAM policies have a limit of 6,144 characters versus an inline role policy's limit of 10,240.
</ParamField>

<ParamField name="iam_role_name" type="string" default="KarpenterController">
  Name of the IAM role.
</ParamField>

<ParamField name="iam_role_use_name_prefix" type="bool" default="true">
  Determines whether the name of the IAM role is used as a prefix.
</ParamField>

<ParamField name="iam_role_path" type="string" default="/">
  Path of the IAM role.
</ParamField>

<ParamField name="iam_role_description" type="string" default="Karpenter controller IAM role">
  IAM role description.
</ParamField>

<ParamField name="iam_role_max_session_duration" type="number" default="null">
  Maximum API session duration in seconds between 3600 and 43200.
</ParamField>

<ParamField name="iam_role_permissions_boundary_arn" type="string" default="null">
  Permissions boundary ARN to use for the IAM role.
</ParamField>

<ParamField name="iam_role_tags" type="map(string)" default="{}">
  A map of additional tags to add the the IAM role.
</ParamField>

<ParamField name="iam_role_override_assume_policy_documents" type="list(string)" default="[]">
  A list of IAM policy documents to override the default assume role policy document for the Karpenter controller IAM role.
</ParamField>

<ParamField name="iam_role_source_assume_policy_documents" type="list(string)" default="[]">
  A list of IAM policy documents to use as a source for the assume role policy document for the Karpenter controller IAM role.
</ParamField>

<ParamField name="iam_role_policies" type="map(string)" default="{}">
  Policies to attach to the IAM role in `{'static_name' = 'policy_arn'}` format.
</ParamField>

<ParamField name="iam_policy_name" type="string" default="KarpenterController">
  Name of the IAM policy.
</ParamField>

<ParamField name="iam_policy_use_name_prefix" type="bool" default="true">
  Determines whether the name of the IAM policy is used as a prefix.
</ParamField>

<ParamField name="iam_policy_path" type="string" default="/">
  Path of the IAM policy.
</ParamField>

<ParamField name="iam_policy_description" type="string" default="Karpenter controller IAM policy">
  IAM policy description.
</ParamField>

<ParamField name="iam_policy_statements" type="list(object)" default="null">
  A list of IAM policy statements - used for adding specific IAM permissions as needed.

  <Expandable title="statement object fields">
    <ParamField name="sid" type="string" default="null">Statement ID.</ParamField>
    <ParamField name="actions" type="list(string)" default="null">List of IAM actions.</ParamField>
    <ParamField name="not_actions" type="list(string)" default="null">List of IAM actions to explicitly not allow.</ParamField>
    <ParamField name="effect" type="string" default="null">Effect of the statement: `Allow` or `Deny`.</ParamField>
    <ParamField name="resources" type="list(string)" default="null">List of ARNs the statement applies to.</ParamField>
    <ParamField name="not_resources" type="list(string)" default="null">List of ARNs the statement explicitly does not apply to.</ParamField>
    <ParamField name="principals" type="list(object)" default="null">List of principals the statement applies to.</ParamField>
    <ParamField name="not_principals" type="list(object)" default="null">List of principals the statement explicitly does not apply to.</ParamField>
    <ParamField name="condition" type="list(object)" default="null">List of conditions for the statement.</ParamField>
  </Expandable>
</ParamField>

<ParamField name="ami_id_ssm_parameter_arns" type="list(string)" default="[]">
  List of SSM Parameter ARNs that Karpenter controller is allowed read access (for retrieving AMI IDs).
</ParamField>

### Pod Identity Association

<ParamField name="create_pod_identity_association" type="bool" default="true">
  Determines whether to create pod identity association.
</ParamField>

<ParamField name="namespace" type="string" default="kube-system">
  Namespace to associate with the Karpenter Pod Identity.
</ParamField>

<ParamField name="service_account" type="string" default="karpenter">
  Service account to associate with the Karpenter Pod Identity.
</ParamField>

### Node Termination Queue

<ParamField name="enable_spot_termination" type="bool" default="true">
  Determines whether to enable native spot termination handling.
</ParamField>

<ParamField name="queue_name" type="string" default="null">
  Name of the SQS queue.
</ParamField>

<ParamField name="queue_managed_sse_enabled" type="bool" default="true">
  Boolean to enable server-side encryption (SSE) of message content with SQS-owned encryption keys.
</ParamField>

<ParamField name="queue_kms_master_key_id" type="string" default="null">
  The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK.
</ParamField>

<ParamField name="queue_kms_data_key_reuse_period_seconds" type="number" default="null">
  The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again.
</ParamField>

<ParamField name="queue_policy_statements" type="map(object)" default="null">
  A list of IAM policy statements - used for adding specific SQS queue policy permissions as needed.
</ParamField>

### Node IAM Role

<ParamField name="create_node_iam_role" type="bool" default="true">
  Determines whether an IAM role is created or to use an existing IAM role.
</ParamField>

<ParamField name="cluster_ip_family" type="string" default="ipv4">
  The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6`. Note: If `ipv6` is specified, the `AmazonEKS_CNI_IPv6_Policy` must exist in the account.
</ParamField>

<ParamField name="node_iam_role_arn" type="string" default="null">
  Existing IAM role ARN for the IAM instance profile. Required if `create_node_iam_role` is set to `false`.
</ParamField>

<ParamField name="node_iam_role_name" type="string" default="null">
  Name to use on IAM role created.
</ParamField>

<ParamField name="node_iam_role_use_name_prefix" type="bool" default="true">
  Determines whether the Node IAM role name is used as a prefix.
</ParamField>

<ParamField name="node_iam_role_path" type="string" default="/">
  IAM role path.
</ParamField>

<ParamField name="node_iam_role_description" type="string" default="null">
  Description of the role.
</ParamField>

<ParamField name="node_iam_role_max_session_duration" type="number" default="null">
  Maximum API session duration in seconds between 3600 and 43200.
</ParamField>

<ParamField name="node_iam_role_permissions_boundary" type="string" default="null">
  ARN of the policy that is used to set the permissions boundary for the IAM role.
</ParamField>

<ParamField name="node_iam_role_attach_cni_policy" type="bool" default="true">
  Whether to attach the `AmazonEKS_CNI_Policy`/`AmazonEKS_CNI_IPv6_Policy` IAM policy to the IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster.
</ParamField>

<ParamField name="node_iam_role_additional_policies" type="map(string)" default="{}">
  Additional policies to be added to the IAM role.
</ParamField>

<ParamField name="node_iam_role_tags" type="map(string)" default="{}">
  A map of additional tags to add to the IAM role created.
</ParamField>

### Access Entry

<ParamField name="create_access_entry" type="bool" default="true">
  Determines whether an access entry is created for the IAM role used by the node IAM role.
</ParamField>

<ParamField name="access_entry_type" type="string" default="EC2_LINUX">
  Type of the access entry. `EC2_LINUX`, `FARGATE_LINUX`, or `EC2_WINDOWS`; defaults to `EC2_LINUX`.
</ParamField>

### Instance Profile

<ParamField name="create_instance_profile" type="bool" default="false">
  Whether to create an IAM instance profile.
</ParamField>

### EventBridge Rules

<ParamField name="rule_name_prefix" type="string" default="Karpenter">
  Prefix used for all event bridge rules.
</ParamField>

***

## Outputs

### Controller IAM Role

<ResponseField name="iam_role_name" type="string">
  The name of the controller IAM role.
</ResponseField>

<ResponseField name="iam_role_arn" type="string">
  The Amazon Resource Name (ARN) specifying the controller IAM role.
</ResponseField>

<ResponseField name="iam_role_unique_id" type="string">
  Stable and unique string identifying the controller IAM role.
</ResponseField>

### Node Termination Queue

<ResponseField name="queue_arn" type="string">
  The ARN of the SQS queue.
</ResponseField>

<ResponseField name="queue_name" type="string">
  The name of the created Amazon SQS queue.
</ResponseField>

<ResponseField name="queue_url" type="string">
  The URL for the created Amazon SQS queue.
</ResponseField>

### Event Rules

<ResponseField name="event_rules" type="map">
  Map of the event rules created and their attributes.
</ResponseField>

### Node IAM Role

<ResponseField name="node_iam_role_name" type="string">
  The name of the node IAM role.
</ResponseField>

<ResponseField name="node_iam_role_arn" type="string">
  The Amazon Resource Name (ARN) specifying the node IAM role.
</ResponseField>

<ResponseField name="node_iam_role_unique_id" type="string">
  Stable and unique string identifying the node IAM role.
</ResponseField>

### Access Entry

<ResponseField name="node_access_entry_arn" type="string">
  Amazon Resource Name (ARN) of the node Access Entry.
</ResponseField>

### Instance Profile

<ResponseField name="instance_profile_arn" type="string">
  ARN assigned by AWS to the instance profile.
</ResponseField>

<ResponseField name="instance_profile_id" type="string">
  Instance profile's ID.
</ResponseField>

<ResponseField name="instance_profile_name" type="string">
  Name of the instance profile.
</ResponseField>

<ResponseField name="instance_profile_unique" type="string">
  Stable and unique string identifying the IAM instance profile.
</ResponseField>

### Pod Identity

<ResponseField name="namespace" type="string">
  Namespace associated with the Karpenter Pod Identity.
</ResponseField>

<ResponseField name="service_account" type="string">
  Service Account associated with the Karpenter Pod Identity.
</ResponseField>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.