karpenter: iam:PassedToService has to be ec2.amazonaws.com.cn in AWS China

[fanyang01]

Description

I got the following error from Karpenter's logs when creating a new pod on an EKS cluster freshly created in the cn-northwest-1 region with Karpenter installed:

launching nodeclaim, creating instance, with fleet error(s), UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws-cn:sts::xxxxx:assumed-role/xxxx-karpenter-controller-role/xxxxx is not authorized to perform: iam:PassRole on resource: arn:aws-cn:iam::xxxx:role/xxxxx-karpenter-node-role because no identity-based policy allows the iam:PassRole action.

The root cause appears to be the following code:

terraform-aws-eks/modules/karpenter/main.tf

Lines 269 to 280 in a7ff103

	statement {
	sid = "AllowPassingInstanceRole"
	resources = var.create_node_iam_role ? [aws_iam_role.node[0].arn] : [var.node_iam_role_arn]
	actions = ["iam:PassRole"]
	condition {
	test = "StringEquals"
	variable = "iam:PassedToService"
	values = ["ec2.amazonaws.com"]
	}
	}

I have manually changed ec2.amazonaws.com to ec2.amazonaws.com.cn in the policy document attached to the controller role. Then the pod can be scheduled successfully by Karpenter and the error disappears.

• ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]: 20.13

• Terraform version:

Terraform v1.3.9
on darwin_arm64
+ provider registry.terraform.io/alekc/kubectl v2.0.4
+ provider registry.terraform.io/hashicorp/aws v5.52.0
+ provider registry.terraform.io/hashicorp/cloudinit v2.3.4
+ provider registry.terraform.io/hashicorp/helm v2.13.2
+ provider registry.terraform.io/hashicorp/kubernetes v2.30.0
+ provider registry.terraform.io/hashicorp/null v3.2.2
+ provider registry.terraform.io/hashicorp/time v0.11.2
+ provider registry.terraform.io/hashicorp/tls v4.0.5

Reproduction Code [Required]

module "karpenter" {
  source  = "terraform-aws-modules/eks/aws//modules/karpenter"
  version = "~> 20.13"

  cluster_name = module.eks.cluster_name

  iam_role_name              = "${local.cluster_name}-karpenter-controller-role"
  iam_policy_name            = "${local.cluster_name}-karpenter-controller-policy"
  iam_role_use_name_prefix   = false
  iam_policy_use_name_prefix = false

  node_iam_role_name            = "${local.cluster_name}-karpenter-node-role"
  node_iam_role_use_name_prefix = false

  enable_spot_termination = true
  enable_pod_identity     = true

  tags = local.tags
}

Actual behavior

Karpenter failed to provision EC2 nodes for a pending pod.

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days