Insufficient permissions when using karpenter irsa without discovery tags

[apamildner]

Description

The issue is described in the PR

Versions

• Module version [Required]: v5.5.0

Reproduction Code [Required]

Steps to reproduce the behavior:

1. Create AWSNodeTemplate like this

apiVersion: karpenter.k8s.aws/v1alpha1
kind: AWSNodeTemplate
metadata:
  name: default
spec:
  subnetSelector:
    aws-ids: subnet-abc,subnet-xyz
  securityGroupSelector:
    aws-ids: sg-abc,sg-xyz
  tags:
    karpenter.sh/discovery/foo-cluster: foo-cluster

2. Make karpenter try to create a new node with a provisioner pointing to the above mentioned template
3. Make sure the security groups you try to use doesn't have the tag karpenter.sh/discovery/foo-cluster: foo-cluster instead refer to them with their ID's

Expected behavior

The node comes up without a problem

Actual behavior

The karpenter controller fails to run the instance, and instead gives me an UnAuthorizedError which it prints in the logs.
The message indicates that I miss the correct privilege to run ec2:RunInstances since the security group I try to use is missing the ec2:ResourceTag/karpenter.sh/discovery/foo-cluster.

[egeturgay]

I have come across the same issue today. This is due to the conditional on the runInstances policy.

The use case for this is, the EKS cluster and the its worker security group is provisioned by using the public terraform module. In the event that the same worker SG is being used for Karpenter managed instances, the policy linked below prevents it to run instances.
Removing the conditional on RunInstances addresses the problem and It would be good to get the module reflect this.

https://github.com/terraform-aws-modules/terraform-aws-iam/blob/v5.5.2/modules/iam-role-for-service-accounts-eks/policies.tf#L555

[antonbabenko]

This issue has been resolved in version 5.5.4 🎉

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.