add Cluster Autoscaler IRSA role and policy

terraform/aws/modules/2-nbs7/eks-nbs/irsa.tf

@@ -129,4 +129,71 @@
       }
     ]
   })
+}
+
+# ──────────────────────────────────────────────────────────
+# Cluster Autoscaler IRSA
+# ──────────────────────────────────────────────────────────
+
+module "cluster_autoscaler_irsa_role" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
+  version = ">=6.2.3, <7.0.0"
+
+  name   = "${local.eks_name}-cluster-autoscaler"
+  create = var.create_cluster_autoscaler_irsa
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["kube-system:cluster-autoscaler-aws-cluster-autoscaler"]
+    }
+  }
+
+  policies = {
+    policy = try(aws_iam_policy.cluster_autoscaler_irsa_policy[0].arn, null)
+  }
+}
+
+resource "aws_iam_policy" "cluster_autoscaler_irsa_policy" {
+  count       = var.create_cluster_autoscaler_irsa ? 1 : 0
+  name        = "${local.eks_name}-cluster-autoscaler-policy"
+  description = "Cluster Autoscaler permissions for EKS node group scaling"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "ClusterAutoscalerDescribe"
+        Effect = "Allow"
+        Action = [
+          "autoscaling:DescribeAutoScalingGroups",
+          "autoscaling:DescribeAutoScalingInstances",
+          "autoscaling:DescribeLaunchConfigurations",
+          "autoscaling:DescribeScalingActivities",
+          "autoscaling:DescribeTags",
+          "ec2:DescribeImages",
+          "ec2:DescribeInstanceTypes",
+          "ec2:DescribeLaunchTemplateVersions",
+          "ec2:GetInstanceTypesFromInstanceRequirements",
+          "eks:DescribeNodegroup"
+        ]
+        Resource = ["*"]
+      },
+      {
+        Sid    = "ClusterAutoscalerScale"
+        Effect = "Allow"
+        Action = [
+          "autoscaling:SetDesiredCapacity",
+          "autoscaling:TerminateInstanceInAutoScalingGroup"
+        ]
+        Resource = ["*"]
+        Condition = {
+          StringEquals = {
+            "aws:ResourceTag/k8s.io/cluster-autoscaler/enabled"                  = "true"
+            "aws:ResourceTag/k8s.io/cluster-autoscaler/${var.cluster_autoscaler_cluster_name}" = "owned"
+          }
+        }
+      }
+    ]
+  })
 }

terraform/aws/modules/2-nbs7/eks-nbs/outputs.tf

@@ -42,4 +42,9 @@ output "readonly_role_arns" {
 output "otel_collector_role_arn" {
   description = "OTEL Collector IRSA role ARN — pass to helm install via --set serviceAccount.annotations"
   value       = var.create_otel_collector_irsa ? module.otel_collector_irsa_role.arn : null
+}
+
+output "cluster_autoscaler_irsa_role_arn" {
+  description = "ARN of the Cluster Autoscaler IRSA role"
+  value       = var.create_cluster_autoscaler_irsa ? module.cluster_autoscaler_irsa_role.arn : null
 }

terraform/aws/modules/2-nbs7/eks-nbs/variables.tf

@@ -254,3 +254,15 @@ variable "datacompare_s3_bucket_keyname_prefix" {
     error_message = "The datacompare_s3_bucket_keyname_prefix variable must be an empty string or end with a forward slash (/). Example: 'myFolder/' or \"\"."
   }
 }
+
+variable "create_cluster_autoscaler_irsa" {
+  description = "Whether to create the Cluster Autoscaler IRSA role and policy"
+  type        = bool
+  default     = false
+}
+
+variable "cluster_autoscaler_cluster_name" {
+  description = "EKS cluster name for Cluster Autoscaler IAM policy tag-based scoping"
+  type        = string
+  default     = ""
+}