feat(otel): add Karpenter metrics integration test

terraform/eks/daemon/otel/main.tf

@@ -110,6 +110,98 @@ resource "aws_eks_addon" "pod_identity_agent" {
   addon_name   = "eks-pod-identity-agent"
 }
 
+# --- Karpenter Controller IAM Role (Pod Identity) ---
+
+resource "aws_iam_role" "karpenter_controller" {
+  name = "cwagent-otel-karpenter-${module.common.testing_id}"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "pods.eks.amazonaws.com" }
+      Action    = ["sts:AssumeRole", "sts:TagSession"]
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "karpenter_controller" {
+  name = "KarpenterControllerPolicy"
+  role = aws_iam_role.karpenter_controller.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "EC2Permissions"
+        Effect = "Allow"
+        Action = [
+          "ec2:CreateFleet",
+          "ec2:CreateLaunchTemplate",
+          "ec2:CreateTags",
+          "ec2:DeleteLaunchTemplate",
+          "ec2:DescribeAvailabilityZones",
+          "ec2:DescribeImages",
+          "ec2:DescribeInstances",
+          "ec2:DescribeInstanceTypeOfferings",
+          "ec2:DescribeInstanceTypes",
+          "ec2:DescribeLaunchTemplates",
+          "ec2:DescribeSecurityGroups",
+          "ec2:DescribeSubnets",
+          "ec2:RunInstances",
+          "ec2:TerminateInstances",
+        ]
+        Resource = "*"
+      },
+      {
+        Sid      = "PassRoleToEC2"
+        Effect   = "Allow"
+        Action   = "iam:PassRole"
+        Resource = aws_iam_role.node_role.arn
+      },
+      {
+        Sid      = "EKSPermissions"
+        Effect   = "Allow"
+        Action   = "eks:DescribeCluster"
+        Resource = aws_eks_cluster.this.arn
+      },
+      {
+        Sid      = "SSMGetParameter"
+        Effect   = "Allow"
+        Action   = "ssm:GetParameter"
+        Resource = "arn:aws:ssm:${var.region}::parameter/aws/service/*"
+      },
+      {
+        Sid      = "PricingPermissions"
+        Effect   = "Allow"
+        Action   = "pricing:GetProducts"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+# Karpenter Pod Identity Association
+resource "aws_eks_pod_identity_association" "karpenter_controller" {
+  depends_on      = [aws_eks_addon.pod_identity_agent]
+  cluster_name    = aws_eks_cluster.this.name
+  namespace       = "kube-system"
+  service_account = "karpenter"
+  role_arn        = aws_iam_role.karpenter_controller.arn
+}
+
+# Tag subnets and security group for Karpenter discovery
+resource "aws_ec2_tag" "subnet_karpenter" {
+  count       = length(module.basic_components.public_subnet_ids)
+  resource_id = module.basic_components.public_subnet_ids[count.index]
+  key         = "karpenter.sh/discovery"
+  value       = aws_eks_cluster.this.name
+}
+
+resource "aws_ec2_tag" "sg_karpenter" {
+  resource_id = module.basic_components.security_group
+  key         = "karpenter.sh/discovery"
+  value       = aws_eks_cluster.this.name
+}
+
 # --- Update kubeconfig ---
 
 resource "null_resource" "kubectl" {
@@ -119,6 +211,87 @@ resource "null_resource" "kubectl" {
   }
 }
 
+# --- Karpenter Helm install ---
+
+resource "helm_release" "karpenter" {
+  name             = "karpenter"
+  repository       = "oci://public.ecr.aws/karpenter"
+  chart            = "karpenter"
+  version          = var.karpenter_version
+  namespace        = "kube-system"
+  create_namespace = false
+
+  set = [
+    { name = "settings.clusterName", value = aws_eks_cluster.this.name },
+    { name = "settings.clusterEndpoint", value = aws_eks_cluster.this.endpoint },
+    { name = "controller.resources.requests.cpu", value = "100m" },
+    { name = "controller.resources.requests.memory", value = "256Mi" },
+  ]
+
+  depends_on = [
+    aws_eks_addon.pod_identity_agent,
+    aws_eks_pod_identity_association.karpenter_controller,
+    null_resource.kubectl,
+  ]
+}
+
+# --- Karpenter NodePool + EC2NodeClass (minimal, for metric generation) ---
+
+resource "null_resource" "karpenter_nodepool" {
+  depends_on = [helm_release.karpenter]
+  provisioner "local-exec" {
+    command = <<-EOT
+      cat <<'EOF' | kubectl apply -f -
+      apiVersion: karpenter.sh/v1
+      kind: NodePool
+      metadata:
+        name: default
+      spec:
+        template:
+          spec:
+            nodeClassRef:
+              group: karpenter.k8s.aws
+              kind: EC2NodeClass
+              name: default
+            requirements:
+              - key: "karpenter.k8s.aws/instance-category"
+                operator: In
+                values: ["t"]
+              - key: "karpenter.k8s.aws/instance-size"
+                operator: In
+                values: ["medium", "large"]
+              - key: "kubernetes.io/arch"
+                operator: In
+                values: ["amd64"]
+              - key: "karpenter.sh/capacity-type"
+                operator: In
+                values: ["on-demand"]
+        limits:
+          cpu: "4"
+          memory: "8Gi"
+        disruption:
+          consolidationPolicy: WhenEmpty
+          consolidateAfter: 60s
+      ---
+      apiVersion: karpenter.k8s.aws/v1
+      kind: EC2NodeClass
+      metadata:
+        name: default
+      spec:
+        role: "${aws_iam_role.node_role.name}"
+        amiSelectorTerms:
+          - alias: al2023@latest
+        subnetSelectorTerms:
+          - tags:
+              karpenter.sh/discovery: "${aws_eks_cluster.this.name}"
+        securityGroupSelectorTerms:
+          - tags:
+              karpenter.sh/discovery: "${aws_eks_cluster.this.name}"
+      EOF
+    EOT
+  }
+}
+
 # --- Helm chart install ---
 
 data "external" "clone_helm_chart" {
@@ -140,12 +313,14 @@ resource "helm_release" "aws_observability" {
     { name = "clusterName", value = aws_eks_cluster.this.name },
     { name = "region", value = var.region },
     { name = "otelContainerInsights.enabled", value = "true" },
+    { name = "otelContainerInsights.integrations.karpenter.enabled", value = "true" },
   ]
 
   depends_on = [
     aws_eks_addon.pod_identity_agent,
     null_resource.kubectl,
     data.external.clone_helm_chart,
+    helm_release.karpenter,
   ]
 }
 
@@ -351,6 +526,7 @@ resource "null_resource" "validator" {
   depends_on = [
     null_resource.restart_pods,
     kubernetes_deployment_v1.nginx_test,
+    null_resource.karpenter_nodepool,
   ]
 
   triggers = { always_run = timestamp() }
@@ -368,6 +544,13 @@ resource "null_resource" "validator" {
         -computeType=EKS \
         -eksDeploymentStrategy=DAEMON \
         -region=${var.region}
+
+      echo "Running OTEL integrations tests (Karpenter)..."
+      go test -tags integration -timeout 1h -v ./test/otel/integrations/karpenter/... \
+        -eksClusterName=${aws_eks_cluster.this.name} \
+        -computeType=EKS \
+        -eksDeploymentStrategy=DAEMON \
+        -region=${var.region}
     EOT
   }
 }

terraform/eks/daemon/otel/variables.tf

@@ -40,3 +40,8 @@ variable "instance_type" {
   type    = string
   default = "t3.medium"
 }
+
+variable "karpenter_version" {
+  type    = string
+  default = "1.13.0"
+}