Skip to content

Commit 8b77bb4

Browse files
mikkeloscarmikkeloscar
committed
Update to Karpenter v1.7.1
Signed-off-by: Mikkel Oscar Lyderik Larsen <[email protected]>
1 parent 94e6d0e commit 8b77bb4

File tree

5 files changed

+27
-36
lines changed

5 files changed

+27
-36
lines changed

‎cluster/manifests/z-karpenter/05-clusterrole-core.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ metadata:
1010
rules:
1111
# Read
1212
- apiGroups: ["karpenter.sh"]
13-
resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"]
13+
resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status", "nodeoverlays", "nodeoverlays/status"]
1414
verbs: ["get", "list", "watch"]
1515
- apiGroups: [""]
1616
resources: ["pods", "nodes", "persistentvolumes", "persistentvolumeclaims", "replicationcontrollers", "namespaces"]
@@ -32,7 +32,7 @@ rules:
3232
resources: ["nodeclaims", "nodeclaims/status"]
3333
verbs: ["create", "delete", "update", "patch"]
3434
- apiGroups: ["karpenter.sh"]
35-
resources: ["nodepools", "nodepools/status"]
35+
resources: ["nodepools", "nodepools/status", "nodeoverlays/status"]
3636
verbs: ["update", "patch"]
3737
- apiGroups: [""]
3838
resources: ["events"]

‎cluster/manifests/z-karpenter/07-karpenter.k8s.aws_ec2nodeclasses.yaml‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.18.0
6+
controller-gen.kubebuilder.io/version: v0.19.0
77
name: ec2nodeclasses.karpenter.k8s.aws
88
spec:
99
group: karpenter.k8s.aws
@@ -503,17 +503,12 @@ spec:
503503
type: object
504504
role:
505505
description: |-
506-
Role is the AWS identity that nodes use. This field is immutable.
506+
Role is the AWS identity that nodes use.
507507
This field is mutually exclusive from instanceProfile.
508-
Marking this field as immutable avoids concerns around terminating managed instance profiles from running instances.
509-
This field may be made mutable in the future, assuming the correct garbage collection and drift handling is implemented
510-
for the old instance profiles on an update.
511508
type: string
512509
x-kubernetes-validations:
513510
- message: role cannot be empty
514511
rule: self != ''
515-
- message: immutable field changed
516-
rule: self == oldSelf
517512
securityGroupSelectorTerms:
518513
description: SecurityGroupSelectorTerms is a list of security group selector terms. The terms are ORed.
519514
items:
@@ -617,8 +612,6 @@ spec:
617612
x-kubernetes-validations:
618613
- message: must specify exactly one of ['role', 'instanceProfile']
619614
rule: (has(self.role) && !has(self.instanceProfile)) || (!has(self.role) && has(self.instanceProfile))
620-
- message: changing from 'instanceProfile' to 'role' is not supported. You must delete and recreate this node class if you want to change this.
621-
rule: (has(oldSelf.role) && has(self.role)) || (has(oldSelf.instanceProfile) && has(self.instanceProfile))
622615
- message: if set, amiFamily must be 'AL2' or 'Custom' when using an AL2 alias
623616
rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''al2'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''AL2'') : true)'
624617
- message: if set, amiFamily must be 'AL2023' or 'Custom' when using an AL2023 alias

‎cluster/manifests/z-karpenter/08-karpenter.sh_nodeclaims.yaml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.18.0
6+
controller-gen.kubebuilder.io/version: v0.19.0
77
name: nodeclaims.karpenter.sh
88
spec:
99
group: karpenter.sh
@@ -138,7 +138,7 @@ spec:
138138
- message: label "kubernetes.io/hostname" is restricted
139139
rule: self != "kubernetes.io/hostname"
140140
- message: label domain "karpenter.k8s.aws" is restricted
141-
rule: self in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
141+
rule: self in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count", "karpenter.k8s.aws/instance-capability-flex"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
142142
minValues:
143143
description: |-
144144
This field is ALPHA and can be dropped or replaced at any time
@@ -224,9 +224,7 @@ spec:
224224
minLength: 1
225225
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$
226226
timeAdded:
227-
description: |-
228-
TimeAdded represents the time at which the taint was added.
229-
It is only written for NoExecute taints.
227+
description: TimeAdded represents the time at which the taint was added.
230228
format: date-time
231229
type: string
232230
value:
@@ -261,9 +259,7 @@ spec:
261259
minLength: 1
262260
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$
263261
timeAdded:
264-
description: |-
265-
TimeAdded represents the time at which the taint was added.
266-
It is only written for NoExecute taints.
262+
description: TimeAdded represents the time at which the taint was added.
267263
format: date-time
268264
type: string
269265
value:

‎cluster/manifests/z-karpenter/09-karpenter.sh_nodepools.yaml‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.18.0
6+
controller-gen.kubebuilder.io/version: v0.19.0
77
name: nodepools.karpenter.sh
88
spec:
99
group: karpenter.sh
@@ -207,7 +207,7 @@ spec:
207207
- message: label "kubernetes.io/hostname" is restricted
208208
rule: self.all(x, x != "kubernetes.io/hostname")
209209
- message: label domain "karpenter.k8s.aws" is restricted
210-
rule: self.all(x, x in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws"))
210+
rule: self.all(x, x in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count", "karpenter.k8s.aws/instance-capability-flex"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws"))
211211
type: object
212212
spec:
213213
description: |-
@@ -280,7 +280,7 @@ spec:
280280
- message: label "kubernetes.io/hostname" is restricted
281281
rule: self != "kubernetes.io/hostname"
282282
- message: label domain "karpenter.k8s.aws" is restricted
283-
rule: self in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
283+
rule: self in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count", "karpenter.k8s.aws/instance-capability-flex"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
284284
minValues:
285285
description: |-
286286
This field is ALPHA and can be dropped or replaced at any time
@@ -353,9 +353,7 @@ spec:
353353
minLength: 1
354354
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$
355355
timeAdded:
356-
description: |-
357-
TimeAdded represents the time at which the taint was added.
358-
It is only written for NoExecute taints.
356+
description: TimeAdded represents the time at which the taint was added.
359357
format: date-time
360358
type: string
361359
value:
@@ -390,9 +388,7 @@ spec:
390388
minLength: 1
391389
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$
392390
timeAdded:
393-
description: |-
394-
TimeAdded represents the time at which the taint was added.
395-
It is only written for NoExecute taints.
391+
description: TimeAdded represents the time at which the taint was added.
396392
format: date-time
397393
type: string
398394
value:

‎cluster/manifests/z-karpenter/deployment.yaml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,26 +34,24 @@ spec:
3434
serviceAccountName: karpenter
3535
securityContext:
3636
fsGroup: 65532
37-
runAsNonRoot: false
3837
seccompProfile:
3938
type: RuntimeDefault
4039
priorityClassName: "{{ .Cluster.ConfigItems.system_priority_class }}"
4140
dnsPolicy: ClusterFirst
41+
schedulerName: "default-scheduler"
4242
containers:
4343
- name: controller
4444
securityContext:
4545
privileged: false
46+
allowPrivilegeEscalation: false
47+
readOnlyRootFilesystem: true
48+
runAsNonRoot: true
4649
runAsUser: 65532
4750
runAsGroup: 65532
48-
runAsNonRoot: true
49-
seccompProfile:
50-
type: RuntimeDefault
51-
allowPrivilegeEscalation: false
5251
capabilities:
5352
drop:
5453
- ALL
55-
readOnlyRootFilesystem: true
56-
image: "container-registry.zalando.net/teapot/karpenter:1.6.0-main-40.patched"
54+
image: "container-registry.zalando.net/teapot/karpenter:1.7.1-main-42.patched"
5755
imagePullPolicy: IfNotPresent
5856
env:
5957
- name: KUBERNETES_MIN_VERSION
@@ -84,20 +82,28 @@ spec:
8482
valueFrom:
8583
fieldRef:
8684
fieldPath: metadata.namespace
85+
- name: CPU_REQUESTS
86+
valueFrom:
87+
resourceFieldRef:
88+
containerName: controller
89+
divisor: 1m
90+
resource: requests.cpu
8791
- name: MEMORY_LIMIT
8892
valueFrom:
8993
resourceFieldRef:
9094
containerName: controller
9195
divisor: "0"
9296
resource: limits.memory
9397
- name: FEATURE_GATES
94-
value: "ReservedCapacity=false,SpotToSpotConsolidation=true,NodeRepair=false"
98+
value: "ReservedCapacity=false,SpotToSpotConsolidation=true,NodeRepair=false,NodeOverlay=false"
9599
- name: BATCH_MAX_DURATION
96100
value: "10s"
97101
- name: BATCH_IDLE_DURATION
98102
value: "1s"
99103
- name: PREFERENCE_POLICY
100104
value: "Respect"
105+
- name: MIN_VALUES_POLICY
106+
value: "Strict"
101107
- name: CLUSTER_NAME
102108
value: "{{.Cluster.Name }}"
103109
- name: VM_MEMORY_OVERHEAD_PERCENT

0 commit comments

Comments
 (0)