Skip to content

Commit ffa213f

Browse files
authored
Merge pull request #9040 from zalando-incubator/karpenter-v1.3.1
Update to Karpenter v1.3.2
2 parents 6b1653a + 1b019b2 commit ffa213f

File tree

6 files changed

+91
-15
lines changed

6 files changed

+91
-15
lines changed

cluster/cluster.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1169,7 +1169,8 @@ Resources:
11691169
"arn:${AWS::Partition}:ec2:${AWS::Region}::image/*",
11701170
"arn:${AWS::Partition}:ec2:${AWS::Region}::snapshot/*",
11711171
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:security-group/*",
1172-
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:subnet/*"
1172+
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:subnet/*",
1173+
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:capacity-reservation/*"
11731174
],
11741175
"Action": [
11751176
"ec2:RunInstances",
@@ -1202,7 +1203,8 @@ Resources:
12021203
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:volume/*",
12031204
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:network-interface/*",
12041205
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:launch-template/*",
1205-
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:spot-instances-request/*"
1206+
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:spot-instances-request/*",
1207+
"arn:${AWS::Partition}:ec2:${AWS::Region}:*:capacity-reservation/*"
12061208
],
12071209
"Action": [
12081210
"ec2:RunInstances",
@@ -1295,6 +1297,7 @@ Resources:
12951297
"Resource": "*",
12961298
"Action": [
12971299
"ec2:DescribeAvailabilityZones",
1300+
"ec2:DescribeCapacityReservations",
12981301
"ec2:DescribeImages",
12991302
"ec2:DescribeInstances",
13001303
"ec2:DescribeInstanceTypeOfferings",

cluster/manifests/z-karpenter/02-role.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
{{ if eq .Cluster.ConfigItems.karpenter_pools_enabled "true"}}
2-
32
---
43
# Source: karpenter/templates/role.yaml
54
apiVersion: rbac.authorization.k8s.io/v1

cluster/manifests/z-karpenter/07-karpenter.k8s.aws_ec2nodeclasses.yaml

Lines changed: 79 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.17.1
7+
controller-gen.kubebuilder.io/version: v0.17.2
88
name: ec2nodeclasses.karpenter.k8s.aws
99
spec:
1010
group: karpenter.k8s.aws
@@ -237,6 +237,39 @@ spec:
237237
x-kubernetes-validations:
238238
- message: must have only one blockDeviceMappings with rootVolume
239239
rule: self.filter(x, has(x.rootVolume)?x.rootVolume==true:false).size() <= 1
240+
capacityReservationSelectorTerms:
241+
description: |-
242+
CapacityReservationSelectorTerms is a list of capacity reservation selector terms. Each term is ORed together to
243+
determine the set of eligible capacity reservations.
244+
items:
245+
properties:
246+
id:
247+
description: ID is the capacity reservation id in EC2
248+
pattern: ^cr-[0-9a-z]+$
249+
type: string
250+
ownerID:
251+
description: Owner is the owner id for the ami.
252+
pattern: ^[0-9]{12}$
253+
type: string
254+
tags:
255+
additionalProperties:
256+
type: string
257+
description: |-
258+
Tags is a map of key/value tags used to select capacity reservations.
259+
Specifying '*' for a value selects all values for a given tag key.
260+
maxProperties: 20
261+
type: object
262+
x-kubernetes-validations:
263+
- message: empty tag keys or values aren't supported
264+
rule: self.all(k, k != '' && self[k] != '')
265+
type: object
266+
maxItems: 30
267+
type: array
268+
x-kubernetes-validations:
269+
- message: expected at least one, got none, ['tags', 'id']
270+
rule: self.all(x, has(x.tags) || has(x.id))
271+
- message: '''id'' is mutually exclusive, cannot be set along with tags in a capacity reservation selector term'
272+
rule: '!self.all(x, has(x.id) && (has(x.tags) || has(x.ownerID)))'
240273
context:
241274
description: |-
242275
Context is a Reserved field in EC2 APIs
@@ -467,7 +500,7 @@ spec:
467500
- message: immutable field changed
468501
rule: self == oldSelf
469502
securityGroupSelectorTerms:
470-
description: SecurityGroupSelectorTerms is a list of or security group selector terms. The terms are ORed.
503+
description: SecurityGroupSelectorTerms is a list of security group selector terms. The terms are ORed.
471504
items:
472505
description: |-
473506
SecurityGroupSelectorTerm defines selection logic for a security group used by Karpenter to launch nodes.
@@ -501,12 +534,12 @@ spec:
501534
rule: self.size() != 0
502535
- message: expected at least one, got none, ['tags', 'id', 'name']
503536
rule: self.all(x, has(x.tags) || has(x.id) || has(x.name))
504-
- message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms'
537+
- message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in a security group selector term'
505538
rule: '!self.all(x, has(x.id) && (has(x.tags) || has(x.name)))'
506-
- message: '''name'' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms'
539+
- message: '''name'' is mutually exclusive, cannot be set with a combination of other fields in a security group selector term'
507540
rule: '!self.all(x, has(x.name) && (has(x.tags) || has(x.id)))'
508541
subnetSelectorTerms:
509-
description: SubnetSelectorTerms is a list of or subnet selector terms. The terms are ORed.
542+
description: SubnetSelectorTerms is a list of subnet selector terms. The terms are ORed.
510543
items:
511544
description: |-
512545
SubnetSelectorTerm defines selection logic for a subnet used by Karpenter to launch nodes.
@@ -535,7 +568,7 @@ spec:
535568
rule: self.size() != 0
536569
- message: expected at least one, got none, ['tags', 'id']
537570
rule: self.all(x, has(x.tags) || has(x.id))
538-
- message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in subnetSelectorTerms'
571+
- message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in a subnet selector term'
539572
rule: '!self.all(x, has(x.id) && has(x.tags))'
540573
tags:
541574
additionalProperties:
@@ -638,6 +671,46 @@ spec:
638671
- requirements
639672
type: object
640673
type: array
674+
capacityReservations:
675+
description: |-
676+
CapacityReservations contains the current capacity reservation values that are available to this NodeClass under the
677+
CapacityReservation selectors.
678+
items:
679+
properties:
680+
availabilityZone:
681+
description: The availability zone the capacity reservation is available in.
682+
type: string
683+
endTime:
684+
description: |-
685+
The time at which the capacity reservation expires. Once expired, the reserved capacity is released and Karpenter
686+
will no longer be able to launch instances into that reservation.
687+
format: date-time
688+
type: string
689+
id:
690+
description: The id for the capacity reservation.
691+
pattern: ^cr-[0-9a-z]+$
692+
type: string
693+
instanceMatchCriteria:
694+
description: Indicates the type of instance launches the capacity reservation accepts.
695+
enum:
696+
- open
697+
- targeted
698+
type: string
699+
instanceType:
700+
description: The instance type for the capacity reservation.
701+
type: string
702+
ownerID:
703+
description: The ID of the AWS account that owns the capacity reservation.
704+
pattern: ^[0-9]{12}$
705+
type: string
706+
required:
707+
- availabilityZone
708+
- id
709+
- instanceMatchCriteria
710+
- instanceType
711+
- ownerID
712+
type: object
713+
type: array
641714
conditions:
642715
description: Conditions contains signals for health and readiness
643716
items:

cluster/manifests/z-karpenter/08-karpenter.sh_nodeclaims.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.17.1
7+
controller-gen.kubebuilder.io/version: v0.17.2
88
name: nodeclaims.karpenter.sh
99
spec:
1010
group: karpenter.sh
@@ -135,7 +135,7 @@ spec:
135135
- message: label "kubernetes.io/hostname" is restricted
136136
rule: self != "kubernetes.io/hostname"
137137
- message: label domain "karpenter.k8s.aws" is restricted
138-
rule: self in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
138+
rule: self in ["karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
139139
minValues:
140140
description: |-
141141
This field is ALPHA and can be dropped or replaced at any time

cluster/manifests/z-karpenter/09-karpenter.sh_nodepools.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.17.1
7+
controller-gen.kubebuilder.io/version: v0.17.2
88
name: nodepools.karpenter.sh
99
spec:
1010
group: karpenter.sh
@@ -208,7 +208,7 @@ spec:
208208
- message: label "kubernetes.io/hostname" is restricted
209209
rule: self.all(x, x != "kubernetes.io/hostname")
210210
- message: label domain "karpenter.k8s.aws" is restricted
211-
rule: self.all(x, x in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws"))
211+
rule: self.all(x, x in ["karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws"))
212212
type: object
213213
spec:
214214
description: |-
@@ -281,7 +281,7 @@ spec:
281281
- message: label "kubernetes.io/hostname" is restricted
282282
rule: self != "kubernetes.io/hostname"
283283
- message: label domain "karpenter.k8s.aws" is restricted
284-
rule: self in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
284+
rule: self in ["karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
285285
minValues:
286286
description: |-
287287
This field is ALPHA and can be dropped or replaced at any time

cluster/manifests/z-karpenter/deployment.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ spec:
3232
prometheus.io/scrape: "true"
3333
spec:
3434
dnsPolicy: Default
35+
automountServiceAccountToken: true
3536
serviceAccountName: karpenter
3637
securityContext:
3738
fsGroup: 65532
@@ -50,7 +51,7 @@ spec:
5051
drop:
5152
- ALL
5253
readOnlyRootFilesystem: true
53-
image: "container-registry.zalando.net/teapot/karpenter:1.2.0-main-30.patched"
54+
image: "container-registry.zalando.net/teapot/karpenter:1.3.2-main-36.patched"
5455
imagePullPolicy: IfNotPresent
5556
env:
5657
- name: KUBERNETES_MIN_VERSION

0 commit comments

Comments
 (0)