{"id":"c971af21-ccde-4d40-b510-5f700787fba8","task":"Install Karpenter on Amazon EKS and provision a NodePool with an EC2NodeClass","domain":"karpenter.sh","steps":["Install prerequisite tools (AWS CLI, kubectl, eksctl >= v0.202.0, helm) and create an EKS cluster with eksctl, tagging cluster resources with karpenter.sh/discovery=<CLUSTER_NAME> and provisioning the KarpenterNodeRole plus an IRSA/Pod Identity association for the karpenter service account via the getting-started cloudformation.yaml.","Install Karpenter with Helm from the public OCI registry, e.g. `helm registry logout public.ecr.aws && helm upgrade --install karpenter oci://public.ecr.aws/karpenter/karpenter --version <KARPENTER_VERSION> --namespace kube-system --create-namespace --set settings.clusterName=<CLUSTER_NAME> --set settings.interruptionQueue=<CLUSTER_NAME>`.","Create an EC2NodeClass (apiVersion karpenter.k8s.aws/v1) with spec.role (or spec.instanceProfile), a required spec.amiSelectorTerms entry (e.g. `alias: al2023@<version>`), and spec.subnetSelectorTerms / spec.securityGroupSelectorTerms matching the karpenter.sh/discovery tag.","Create a NodePool (apiVersion karpenter.sh/v1) whose spec.template.spec.nodeClassRef points at the EC2NodeClass (group: karpenter.k8s.aws, kind: EC2NodeClass, name: default), with spec.template.spec.requirements (kubernetes.io/arch, kubernetes.io/os, karpenter.sh/capacity-type, karpenter.k8s.aws/instance-category) and a spec.limits.cpu ceiling.","Apply both manifests with kubectl, then scale a test deployment (e.g. the pause-image 'inflate' deployment) to trigger provisioning and confirm nodes join via `kubectl get nodeclaims` and `kubectl get nodes`.","Tail controller logs with `kubectl logs -f -n kube-system -l app.kubernetes.io/name=karpenter -c controller` to confirm successful instance launch and EC2NodeClass Ready status."],"gotchas":["Karpenter provisions nothing until at least one NodePool exists and its referenced EC2NodeClass reports Ready in status.conditions — misconfigured subnetSelectorTerms or securityGroupSelectorTerms silently blocks provisioning rather than erroring loudly.","amiSelectorTerms is a required EC2NodeClass field with no implicit default; amiFamily alone (without an amiSelectorTerms.alias) will not resolve an AMI and nodes will fail to launch.","The Helm chart is pulled unauthenticated from a public OCI registry, so you must `helm registry logout public.ecr.aws` first, and IRSA/Pod Identity permissions must fully propagate before nodes can launch or you'll see IAM AccessDenied errors in controller logs."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/c971af21-ccde-4d40-b510-5f700787fba8"}