karpenter

# -- Overrides the chart's name.

nameOverride: ""

# -- Overrides the chart's computed fullname.

fullnameOverride: ""

# -- Additional labels to add into metadata.

additionalLabels: {}

# app: karpenter

# -- Additional annotations to add into metadata.

additionalAnnotations: {}

# -- Image pull policy for Docker images.

imagePullPolicy: IfNotPresent

# -- Image pull secrets for Docker images.

imagePullSecrets: []

service:

# -- Additional annotations for the Service.

annotations: {}

serviceAccount:

# -- Specifies if a ServiceAccount should be created.

create: true

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the fullname template.

name: ""

# -- Additional annotations for the ServiceAccount.

annotations: {}

# -- Specifies additional rules for the core ClusterRole.

additionalClusterRoleRules: []

serviceMonitor:

# -- Specifies whether a ServiceMonitor should be created.

enabled: false

# -- Additional labels for the ServiceMonitor.

additionalLabels: {}

# -- Relabelings for the `http-metrics` endpoint on the ServiceMonitor.

# For more details on relabelings, see: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

relabelings: []

# -- Metric relabelings for the `http-metrics` endpoint on the ServiceMonitor.

# For more details on metric relabelings, see: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs

metricRelabelings: []

# -- Configuration on `http-metrics` endpoint for the ServiceMonitor.

# Not to be used to add additional endpoints.

# See the Prometheus operator documentation for configurable fields https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#endpoint

endpointConfig: {}

# -- Specifies the sampleLimit for prometheus scrapes.

# Per-scrape limit on the number of scraped samples that will be accepted.

# If more than this number of samples are present after metric relabeling

# the entire scrape will be treated as failed. 0 means no limit.

sampleLimit: null

# -- Number of replicas.

replicas: 2

# -- The number of old ReplicaSets to retain to allow rollback.

revisionHistoryLimit: 10

# -- Strategy for updating the pod.

strategy:

rollingUpdate:

maxUnavailable: 1

# -- Additional labels for the pod.

podLabels: {}

# -- Additional annotations for the pod.

podAnnotations: {}

podDisruptionBudget:

name: karpenter

maxUnavailable: 1

# -- SecurityContext for the pod.

podSecurityContext:

fsGroup: 65532

seccompProfile:

type: RuntimeDefault

# -- PriorityClass name for the pod.

priorityClassName: system-cluster-critical

# -- Override the default termination grace period for the pod.

terminationGracePeriodSeconds:

# -- Bind the pod to the host network.

# This is required when using a custom CNI.

hostNetwork: false

# -- Specify which Kubernetes scheduler should dispatch the pod.

schedulerName: default-scheduler

# -- Configure the DNS Policy for the pod

dnsPolicy: ClusterFirst

# -- Configure DNS Config for the pod

dnsConfig: {}

# options:

# - name: ndots

# value: "1"

# -- add additional initContainers to run before karpenter container starts

initContainers: {}

# - name: list-ec2-instances

# image: amazon/aws-cli:latest

# command: [ 'aws', 'ec2', 'describe-instance-types']

# -- Node selectors to schedule the pod to nodes with labels.

nodeSelector:

kubernetes.io/os: linux

# -- Affinity rules for scheduling the pod. If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels.

affinity:

nodeAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

nodeSelectorTerms:

- matchExpressions:

- key: karpenter.sh/nodepool

operator: DoesNotExist

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- topologyKey: "kubernetes.io/hostname"

# -- Topology spread constraints to increase the controller resilience by distributing pods across the cluster zones. If an explicit label selector is not provided one will be created from the pod selector labels.

topologySpreadConstraints:

- maxSkew: 1

topologyKey: topology.kubernetes.io/zone

whenUnsatisfiable: DoNotSchedule

# -- Tolerations to allow the pod to be scheduled to nodes with taints.

tolerations:

- key: CriticalAddonsOnly

operator: Exists

# -- Additional volumes for the pod.

extraVolumes: []

# - name: aws-iam-token

# projected:

# defaultMode: 420

# sources:

# - serviceAccountToken:

# audience: sts.amazonaws.com

# expirationSeconds: 86400

# path: token

controller:

# -- Distinguishing container name (containerName: karpenter-controller).

containerName: controller

image:

# -- Repository path to the controller image.

repository: cgr.dev/chainguard-private/karpenter

# -- Tag of the controller image.

tag: 1.15.0-r2

# -- SHA256 digest of the controller image.

digest: sha256:a362df95f07db5f75ff20bb7add3d4bb990af5efb679730f0618b0e3b8ee3887

# -- Additional environment variables for the controller pod.

env: []

# - name: AWS_REGION

# value: eu-west-1

envFrom: []

securityContext:

# -- AppArmor profile for the controller container.

appArmorProfile: {}

# -- SELinux options for the controller container.

seLinuxOptions: {}

# -- Seccomp profile for the controller container.

seccompProfile: {}

# -- Resources for the controller container.

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# requests:

# cpu: 1

# memory: 1Gi

# limits:

# cpu: 1

# memory: 1Gi

# -- Additional volumeMounts for the controller container.

extraVolumeMounts: []

# - name: aws-iam-token

# mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount

# readOnly: true

# -- Additional sidecarContainer config

sidecarContainer: []

# -- Additional volumeMounts for the sidecar - this will be added to the volume mounts on top of extraVolumeMounts

sidecarVolumeMounts: []

metrics:

# -- The container port to use for metrics.

port: 8080

healthProbe:

# -- The container port to use for http health probe.

port: 8081

# -- Global log level, defaults to 'info'

logLevel: info

# -- Log outputPaths - defaults to stdout only

logOutputPaths:

- stdout

# -- Log errorOutputPaths - defaults to stderr only

logErrorOutputPaths:

- stderr

# -- Global Settings to configure Karpenter

settings:

# -- The maximum length of a batch window. The longer this is, the more pods we can consider for provisioning at one

# time which usually results in fewer but larger nodes.

batchMaxDuration: 10s

# -- The maximum amount of time with no new ending pods that if exceeded ends the current batching window. If pods arrive

# faster than this time, the batching window will be extended up to the maxDuration. If they arrive slower, the pods

# will be batched separately.

batchIdleDuration: 1s

# -- How the Karpenter scheduler should treat preferences. Preferences include preferredDuringSchedulingIgnoreDuringExecution

# node and pod affinities/anti-affinities and ScheduleAnyways topologySpreadConstraints. Can be one of 'Ignore' and 'Respect'

preferencePolicy: Respect

# -- How the Karpenter scheduler treats min values. Options include 'Strict' (fails scheduling when min values can't be met) and 'BestEffort' (relaxes min values when they can't be met).

minValuesPolicy: Strict

# -- Cluster CA bundle for TLS configuration of provisioned nodes. If not set, this is taken from the controller's TLS configuration for the API server.

clusterCABundle: ""

# -- Cluster name.

clusterName: ""

# -- Cluster endpoint. If not set, will be discovered during startup (EKS only).

clusterEndpoint: ""

# -- If true then assume we can't reach AWS services which don't have a VPC endpoint.

# This also has the effect of disabling look-ups to the AWS pricing endpoint.

isolatedVPC: false

# -- Marking this true means that your cluster is running with an EKS control plane and Karpenter should attempt to discover cluster details from the DescribeCluster API.

eksControlPlane: false

# -- The VM memory overhead as a percent that will be subtracted from the total memory for all instance types. The value of `0.075` equals to 7.5%.

vmMemoryOverheadPercent: 0.075

# -- Interruption queue is the name of the SQS queue used for processing interruption events from EC2.

# Interruption handling is disabled if not specified. Enabling interruption handling may

# require additional permissions on the controller service account. Additional permissions are outlined in the docs.

interruptionQueue: ""

# -- Marking this true signals Karpenter to respect zonal shifts when making node claims.

# More information about Zonal Shift here: https://docs.aws.amazon.com/eks/latest/userguide/zone-shift-enable.html#zone-shift-enable-steps

enableZonalShift: false

# -- Reserved ENIs are not included in the calculations for max-pods or kube-reserved.

# This is most often used in the VPC CNI custom networking setup https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html.

reservedENIs: "0"

# -- enableDRA is ALPHA and is disabled by default.

# Setting this to true will enable every AWS DRA driver feature gate (awsFeatureGates.draNVIDIAGPU and

# awsFeatureGates.draEFA) and set ignoreDRARequests to false. It can't be combined with any of those values.

enableDRA: false

# -- (bool) Ignore pods' DRA requests during scheduling simulations. Enabling either AWS DRA feature gate

# (awsFeatureGates.draNVIDIAGPU or awsFeatureGates.draEFA) overrides this to false. Can't be combined with enableDRA.

# @default -- `true`

ignoreDRARequests: null

# -- Run the legacy node repair controller instead of node repair as a disruption method. Only takes effect with

# featureGates.nodeRepair, and can't be combined with featureGates.terminateFirstRepair, which the legacy controller

# doesn't support. The legacy node repair controller is planned for deprecation.

legacyNodeRepair: false

# -- Disable cluster state metrics and events.

disableClusterStateObservability: false

# -- Disable dry run validation for EC2NodeClasses.

disableDryRun: false

# -- How often Karpenter refreshes AMI data from EC2. Increasing this value will reduce the number of

# DescribeImages API calls at the cost of increased staleness in AMI discovery and drift detection. Must be at least 1m.

amiRefreshInterval: 1m

# -- How often Karpenter refreshes subnet data from EC2. Increasing this value will reduce the number of

# DescribeSubnets API calls at the cost of increased staleness in subnet discovery. Must be at least 1m.

subnetRefreshInterval: 1m

# -- How often Karpenter refreshes security group data from EC2. Increasing this value will reduce the number of

# DescribeSecurityGroups API calls at the cost of increased staleness in security group discovery. Must be at least 1m.

securityGroupRefreshInterval: 1m

# -- Feature Gate configuration values. Feature Gates will follow the same graduation process and requirements as feature gates

# in Kubernetes. More information here https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features.

featureGates:

# -- nodeRepair is ALPHA and is disabled by default.

# Setting this to true will enable node repair.

nodeRepair: false

# -- nodeOverlay is ALPHA and is disabled by default.

# Setting this will allow the use of node overlay to impact scheduling decisions

nodeOverlay: false

# -- reservedCapacity is BETA and is enabled by default.

# Setting this will enable native on-demand capacity reservation support.

reservedCapacity: true

# -- spotToSpotConsolidation is ALPHA and is disabled by default.

# Setting this to true will enable spot replacement consolidation for both single and multi-node consolidation.

spotToSpotConsolidation: false

# -- staticCapacity is ALPHA and is disabled by default.

# Setting this to true will enable static capacity provisioning.

staticCapacity: false

# -- capacityBuffer is ALPHA and is disabled by default.

# Setting this to true will enable CapacityBuffer support for pre-provisioning spare capacity.

capacityBuffer: false

# -- terminateFirstDrift is ALPHA and is disabled by default.

# Setting this to true lets drift terminate a node before launching its replacement on a capacity-constrained NodePool.

terminateFirstDrift: false

# -- terminateFirstRepair is ALPHA and is disabled by default.

# Setting this to true lets repair terminate an unhealthy node before launching its replacement on a capacity-constrained NodePool.

terminateFirstRepair: false

# -- podDeletionCostManagement is ALPHA and is disabled by default.

# Setting this to true will enable Karpenter to manage pod-deletion-cost annotations on ReplicaSet pods on its nodes,

# so that ReplicaSet scale-down prefers to remove pods from nodes Karpenter wants to consolidate.

podDeletionCostManagement: false

# -- AWS-specific Feature Gate configuration values.

awsFeatureGates:

# -- nodeClassCEL is ALPHA and is disabled by default.

# Setting this to true will enable CEL validation on EC2NodeClass resources.

nodeClassCEL: false

# -- (bool) draNVIDIAGPU is ALPHA and is disabled by default.

# Setting this to true will make Karpenter calculate the DRA devices the NVIDIA GPU driver publishes,

# so it can account for gpu.nvidia.com claims when it sizes new nodes. Can't be combined with settings.enableDRA.

# @default -- `false`

draNVIDIAGPU: null

# -- (bool) draEFA is ALPHA and is disabled by default.

# Setting this to true will make Karpenter calculate the DRA devices the dranet driver publishes for

# EFA interfaces, so it can account for dra.net claims when it sizes new nodes. Can't be combined with settings.enableDRA.

# @default -- `false`

draEFA: null

# -- rebootForRepair is ALPHA and is disabled by default. It has no effect without the nodeRepair feature gate.

# Setting this to true will make node repair reboot a node in place for reboot-clearable GPU faults instead of

# replacing it. Requires the ec2:RebootInstances permission.

rebootForRepair: false