From 498ea59567a43f324064636bd681263ab72a25d7 Mon Sep 17 00:00:00 2001
From: Ed Robinson <edward-robinson@cookpad.com>
Date: Tue, 31 Oct 2023 10:17:08 +0000
Subject: [PATCH] Allow additional_node_role_arns to be specified on karpenter
 (#353)

This may be needed for migration, if for example karpenter is already
managing nodes with a different node role arn, so that it can
continue to manage existing nodes until they are replaced.
---
 modules/karpenter/controller_iam.tf |  2 +-
 modules/karpenter/variables.tf      | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/modules/karpenter/controller_iam.tf b/modules/karpenter/controller_iam.tf
index 9761714..a4d1bae 100644
--- a/modules/karpenter/controller_iam.tf
+++ b/modules/karpenter/controller_iam.tf
@@ -244,7 +244,7 @@ data "aws_iam_policy_document" "karpenter_controller" {
   statement {
     sid       = "AllowPassingInstanceRole"
     effect    = "Allow"
-    resources = [aws_iam_role.karpenter_node.arn]
+    resources = concat([aws_iam_role.karpenter_node.arn], var.additional_node_role_arns)
     actions   = ["iam:PassRole"]
 
     condition {
diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf
index 4f4a9eb..9b55d28 100644
--- a/modules/karpenter/variables.tf
+++ b/modules/karpenter/variables.tf
@@ -16,3 +16,15 @@ variable "oidc_config" {
     arn = string
   })
 }
+
+variable "additional_node_role_arns" {
+  description = <<-EOF
+    Additional Node Role ARNS that karpenter should manage
+
+    This can be used where karpenter is using existing node
+    roles, and you want to transition to the namespaced role
+    created by this module
+  EOF
+  type        = list(string)
+  default     = []
+}