Install Karpenter on Amazon EKS and provision a NodePool with an EC2NodeClass
domain: karpenter.sh · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Install prerequisite tools (AWS CLI, kubectl, eksctl >= v0.202.0, helm) and create an EKS cluster with eksctl, tagging cluster resources with karpenter.sh/discovery=<CLUSTER_NAME> and provisioning the KarpenterNodeRole plus an IRSA/Pod Identity association for the karpenter service account via the getting-started cloudformation.yaml.
Install Karpenter with Helm from the public OCI registry, e.g. `helm registry logout public.ecr.aws && helm upgrade --install karpenter oci://public.ecr.aws/karpenter/karpenter --version <KARPENTER_VERSION> --namespace kube-system --create-namespace --set settings.clusterName=<CLUSTER_NAME> --set settings.interruptionQueue=<CLUSTER_NAME>`.
Create an EC2NodeClass (apiVersion karpenter.k8s.aws/v1) with spec.role (or spec.instanceProfile), a required spec.amiSelectorTerms entry (e.g. `alias: al2023@<version>`), and spec.subnetSelectorTerms / spec.securityGroupSelectorTerms matching the karpenter.sh/discovery tag.
Create a NodePool (apiVersion karpenter.sh/v1) whose spec.template.spec.nodeClassRef points at the EC2NodeClass (group: karpenter.k8s.aws, kind: EC2NodeClass, name: default), with spec.template.spec.requirements (kubernetes.io/arch, kubernetes.io/os, karpenter.sh/capacity-type, karpenter.k8s.aws/instance-category) and a spec.limits.cpu ceiling.
Apply both manifests with kubectl, then scale a test deployment (e.g. the pause-image 'inflate' deployment) to trigger provisioning and confirm nodes join via `kubectl get nodeclaims` and `kubectl get nodes`.
Tail controller logs with `kubectl logs -f -n kube-system -l app.kubernetes.io/name=karpenter -c controller` to confirm successful instance launch and EC2NodeClass Ready status.
Known gotchas
Karpenter provisions nothing until at least one NodePool exists and its referenced EC2NodeClass reports Ready in status.conditions — misconfigured subnetSelectorTerms or securityGroupSelectorTerms silently blocks provisioning rather than erroring loudly.
amiSelectorTerms is a required EC2NodeClass field with no implicit default; amiFamily alone (without an amiSelectorTerms.alias) will not resolve an AMI and nodes will fail to launch.
The Helm chart is pulled unauthenticated from a public OCI registry, so you must `helm registry logout public.ecr.aws` first, and IRSA/Pod Identity permissions must fully propagate before nodes can launch or you'll see IAM AccessDenied errors in controller logs.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?