From c973f2098353e3bf7598522b062eb4bd1cc5bc21 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Thu, 11 Jun 2026 10:07:41 +0200 Subject: [PATCH 01/14] Remove eks_addon_vpccni_prefix_delegation_enabled var and make it enabled by default Signed-off-by: Willi Carlsen --- _sub/compute/eks-addons/main.tf | 2 +- _sub/compute/eks-addons/vars.tf | 6 ------ _sub/compute/eks-nodegroup-managed/main.tf | 1 - _sub/compute/eks-nodegroup-managed/user-data.sh.tftpl | 2 -- _sub/compute/eks-nodegroup-managed/vars.tf | 6 ------ compute/eks-ec2/main.tf | 2 -- compute/eks-ec2/vars.tf | 6 ------ test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl | 1 - 8 files changed, 1 insertion(+), 25 deletions(-) diff --git a/_sub/compute/eks-addons/main.tf b/_sub/compute/eks-addons/main.tf index 9e578b4c0..32b620165 100644 --- a/_sub/compute/eks-addons/main.tf +++ b/_sub/compute/eks-addons/main.tf @@ -4,7 +4,7 @@ resource "aws_eks_addon" "vpc-cni" { addon_version = local.vpccni_version configuration_values = jsonencode({ "env" = { - "ENABLE_PREFIX_DELEGATION" = tostring(var.vpccni_prefix_delegation_enabled) + "ENABLE_PREFIX_DELEGATION" = tostring(true) } }) resolve_conflicts_on_create = "OVERWRITE" diff --git a/_sub/compute/eks-addons/vars.tf b/_sub/compute/eks-addons/vars.tf index 3177cc6ce..9369e13fa 100644 --- a/_sub/compute/eks-addons/vars.tf +++ b/_sub/compute/eks-addons/vars.tf @@ -35,12 +35,6 @@ variable "awsefscsidriver_version_override" { default = "" } -variable "vpccni_prefix_delegation_enabled" { - type = bool - description = "Whether to enable prefix delegation mode on the VPC CNI addon." - default = false -} - variable "most_recent" { type = bool default = false diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 782705202..6d30585f3 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -12,7 +12,6 @@ resource "aws_launch_template" "eks" { eks_certificate_authority : var.eks_certificate_authority, cluster_name : var.cluster_name, worker_inotify_max_user_watches : var.worker_inotify_max_user_watches, - vpc_cni_prefix_delegation_enabled : var.vpc_cni_prefix_delegation_enabled, cidr : var.eks_service_cidr, max_pods : var.max_pods, kube_cpu : var.kube_reserved_cpu, diff --git a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl index 0e9a74a80..8941904c1 100644 --- a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl +++ b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl @@ -36,9 +36,7 @@ spec: cidr: ${cidr} kubelet: config: -%{ if vpc_cni_prefix_delegation_enabled } maxPods: ${max_pods} -%{ endif ~} registryPullQPS: 0 %{ if kube_cpu != null || kube_memory != null } kubeReserved: diff --git a/_sub/compute/eks-nodegroup-managed/vars.tf b/_sub/compute/eks-nodegroup-managed/vars.tf index ee14e25b1..85d422dc4 100644 --- a/_sub/compute/eks-nodegroup-managed/vars.tf +++ b/_sub/compute/eks-nodegroup-managed/vars.tf @@ -103,12 +103,6 @@ variable "scale_to_zero_cron" { description = "The time when the ASG will be scaled to zero, specified in Unix cron syntax" } -variable "vpc_cni_prefix_delegation_enabled" { - type = bool - description = "Configures the maximum pods limit on the nodes assuming that the prefix delegation feature is enabled on the VPC CNI addon." - default = false -} - variable "max_unavailable" { type = number description = "Desired max number of unavailable worker nodes during node group update." diff --git a/compute/eks-ec2/main.tf b/compute/eks-ec2/main.tf index d46179563..8a438fe6c 100644 --- a/compute/eks-ec2/main.tf +++ b/compute/eks-ec2/main.tf @@ -254,7 +254,6 @@ module "eks_managed_workers_node_group" { eks_endpoint = module.eks_cluster.eks_endpoint eks_certificate_authority = module.eks_cluster.eks_certificate_authority eks_service_cidr = module.eks_cluster.eks_service_cidr - vpc_cni_prefix_delegation_enabled = var.eks_addon_vpccni_prefix_delegation_enabled worker_inotify_max_user_watches = var.eks_worker_inotify_max_user_watches # Node group variations @@ -323,7 +322,6 @@ module "eks_addons" { kubeproxy_version_override = var.eks_addon_kubeproxy_version_override coredns_version_override = var.eks_addon_coredns_version_override vpccni_version_override = var.eks_addon_vpccni_version_override - vpccni_prefix_delegation_enabled = var.eks_addon_vpccni_prefix_delegation_enabled awsebscsidriver_version_override = var.eks_addon_awsebscsidriver_version_override awsefscsidriver_version_override = var.eks_addon_awsefscsidriver_version_override podidentity_version_override = var.eks_addon_podidentity_version_override diff --git a/compute/eks-ec2/vars.tf b/compute/eks-ec2/vars.tf index f54998d02..ce7c450de 100644 --- a/compute/eks-ec2/vars.tf +++ b/compute/eks-ec2/vars.tf @@ -134,12 +134,6 @@ variable "eks_addon_vpccni_version_override" { default = "" } -variable "eks_addon_vpccni_prefix_delegation_enabled" { - type = bool - description = "Whether to enable the prefix delegation mode on the VPC CNI EKS addon." - default = false -} - variable "eks_addon_awsebscsidriver_version_override" { type = string default = "" diff --git a/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl b/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl index 455b19eb0..1489e5204 100644 --- a/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl +++ b/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl @@ -26,7 +26,6 @@ inputs = { eks_cluster_zones = 2 eks_cluster_log_types = ["api", "authenticator", "scheduler", "controllerManager"] - eks_addon_vpccni_prefix_delegation_enabled = true eks_addon_most_recent = false # renovate: eksAddonsFilter={"kubernetesVersion":"1.34","addonName":"vpc-cni"} eks_addon_vpccni_version_override = "v1.22.1-eksbuild.2" From 9931ad0776a2a1abb1574d866a5cd590ba0c0314 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Thu, 11 Jun 2026 10:15:43 +0200 Subject: [PATCH 02/14] Add test to verify prefix delegation is enabled Signed-off-by: Willi Carlsen --- test/integration/suite/vpc_cni_driver_test.go | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/test/integration/suite/vpc_cni_driver_test.go b/test/integration/suite/vpc_cni_driver_test.go index 74c79efdf..1a9cbb807 100644 --- a/test/integration/suite/vpc_cni_driver_test.go +++ b/test/integration/suite/vpc_cni_driver_test.go @@ -1,9 +1,29 @@ package main -import "testing" +import ( + "testing" + + "github.com/gruntwork-io/terratest/modules/k8s" + "github.com/stretchr/testify/assert" +) func TestVpcCniDriverDaemonSet(t *testing.T) { t.Parallel() clientset := NewK8sClientSet(t) AssertK8sDaemonSet(t, clientset, "kube-system", "aws-node") } + +func TestVpcCniPrefixDelegationEnabled(t *testing.T) { + t.Parallel() + options := k8s.NewKubectlOptions("", "", "kube-system") + ds := k8s.GetDaemonSet(t, options, "aws-node") + + prefixDeletegationEnabled := false + for _, env := range ds.Spec.Template.Spec.Containers[0].Env { + if env.Name == "ENABLE_PREFIX_DELEGATION" { + assert.Equal(t, "true", env.Value, "Expected ENABLE_PREFIX_DELEGATION to be set to 'true'") + prefixDeletegationEnabled = true + } + } + assert.True(t, prefixDeletegationEnabled, "ENABLE_PREFIX_DELEGATION environment variable not found") +} From 3820940a92f15048c12929ac1a2b642a161b5014 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Thu, 11 Jun 2026 11:21:57 +0200 Subject: [PATCH 03/14] Swallow changes from #2056 since this is noderoller anyways Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/user-data.sh.tftpl | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl index 8941904c1..71e64af3c 100644 --- a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl +++ b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl @@ -41,19 +41,19 @@ spec: %{ if kube_cpu != null || kube_memory != null } kubeReserved: %{ endif ~} -%{ if kube_cpu != null } +%{ if kube_cpu != null ~} cpu: ${kube_cpu} %{ endif ~} -%{ if kube_memory != null } +%{ if kube_memory != null ~} memory: ${kube_memory} %{ endif ~} -%{ if sys_cpu != null || sys_memory != null } +%{ if sys_cpu != null || sys_memory != null ~} systemReserved: %{ endif ~} -%{ if sys_cpu != null } +%{ if sys_cpu != null ~} cpu: ${sys_cpu} %{ endif ~} -%{ if sys_memory != null } +%{ if sys_memory != null ~} memory: ${sys_memory} %{ endif ~} From bedbd6c93271f323abb627d82d285e900ddbcb6a Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Thu, 11 Jun 2026 13:24:52 +0200 Subject: [PATCH 04/14] Remove variables for overwriting kubeReserved and sysReserved Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/main.tf | 5 +--- .../eks-nodegroup-managed/user-data.sh.tftpl | 18 +------------ _sub/compute/eks-nodegroup-managed/vars.tf | 26 +------------------ compute/eks-ec2/main.tf | 4 --- compute/eks-ec2/vars.tf | 4 --- 5 files changed, 3 insertions(+), 54 deletions(-) diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 6d30585f3..12724d34f 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -14,11 +14,8 @@ resource "aws_launch_template" "eks" { worker_inotify_max_user_watches : var.worker_inotify_max_user_watches, cidr : var.eks_service_cidr, max_pods : var.max_pods, - kube_cpu : var.kube_reserved_cpu, - kube_memory : var.kube_reserved_memory, - sys_cpu : var.system_reserved_cpu, - sys_memory : var.system_reserved_memory, docker_hub_creds : var.docker_hub_creds_ssm_path, + kubelet_memory_reservation : tostring(ceil(255 + (11 * var.max_pods))) + "Mi" })) key_name = var.ec2_ssh_key update_default_version = true diff --git a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl index 71e64af3c..94f85bc35 100644 --- a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl +++ b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl @@ -38,23 +38,7 @@ spec: config: maxPods: ${max_pods} registryPullQPS: 0 -%{ if kube_cpu != null || kube_memory != null } kubeReserved: -%{ endif ~} -%{ if kube_cpu != null ~} - cpu: ${kube_cpu} -%{ endif ~} -%{ if kube_memory != null ~} - memory: ${kube_memory} -%{ endif ~} -%{ if sys_cpu != null || sys_memory != null ~} - systemReserved: -%{ endif ~} -%{ if sys_cpu != null ~} - cpu: ${sys_cpu} -%{ endif ~} -%{ if sys_memory != null ~} - memory: ${sys_memory} -%{ endif ~} + memory: ${kubelet_memory_reservation} --BOUNDARY-- diff --git a/_sub/compute/eks-nodegroup-managed/vars.tf b/_sub/compute/eks-nodegroup-managed/vars.tf index 85d422dc4..810829378 100644 --- a/_sub/compute/eks-nodegroup-managed/vars.tf +++ b/_sub/compute/eks-nodegroup-managed/vars.tf @@ -119,28 +119,4 @@ variable "max_pods" { type = number description = "Maximum number of Pods that can run on the Kubelet" default = 110 -} - -variable "kube_reserved_cpu" { - type = string - description = "CPU reserved for kubernetes system components" - default = null -} - -variable "kube_reserved_memory" { - type = string - description = "Memory reserved for kubernetes system components" - default = null -} - -variable "system_reserved_cpu" { - type = string - description = "CPU reserved for system components" - default = null -} - -variable "system_reserved_memory" { - type = string - description = "Memory reserved for system components" - default = null -} +} \ No newline at end of file diff --git a/compute/eks-ec2/main.tf b/compute/eks-ec2/main.tf index 8a438fe6c..f9e446c4c 100644 --- a/compute/eks-ec2/main.tf +++ b/compute/eks-ec2/main.tf @@ -271,10 +271,6 @@ module "eks_managed_workers_node_group" { for sn in module.eks_managed_workers_subnet.subnets : sn.id if contains(each.value.availability_zones, sn.availability_zone) ] max_pods = each.value.max_pods - kube_reserved_cpu = each.value.kube_cpu - kube_reserved_memory = each.value.kube_memory - system_reserved_cpu = each.value.sys_cpu - system_reserved_memory = each.value.sys_memory # Docker Hub credentials docker_hub_creds_ssm_path = aws_ssm_parameter.dockerhub.name diff --git a/compute/eks-ec2/vars.tf b/compute/eks-ec2/vars.tf index ce7c450de..3b1e7c74d 100644 --- a/compute/eks-ec2/vars.tf +++ b/compute/eks-ec2/vars.tf @@ -194,10 +194,6 @@ variable "eks_managed_nodegroups" { })), []) labels = optional(map(string), {}) max_pods = optional(number, 110) - sys_cpu = optional(string, null) - sys_memory = optional(string, null) - kube_cpu = optional(string, null) - kube_memory = optional(string, null) })) default = {} validation { From 2c6b637c37f18cf5b8776d5ac60b883a55c4685b Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Thu, 11 Jun 2026 14:08:30 +0200 Subject: [PATCH 05/14] Fix string concatination since I'm to stupid to remember Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 12724d34f..26c93f867 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -15,7 +15,7 @@ resource "aws_launch_template" "eks" { cidr : var.eks_service_cidr, max_pods : var.max_pods, docker_hub_creds : var.docker_hub_creds_ssm_path, - kubelet_memory_reservation : tostring(ceil(255 + (11 * var.max_pods))) + "Mi" + kubelet_memory_reservation : "${tostring(ceil(255 + (11 * var.max_pods)))}Mi" })) key_name = var.ec2_ssh_key update_default_version = true From 94abb808160a800355239cdfce6d3325d7848a11 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Thu, 11 Jun 2026 14:36:19 +0200 Subject: [PATCH 06/14] Remove variables from QA testing Signed-off-by: Willi Carlsen --- test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl | 8 -------- 1 file changed, 8 deletions(-) diff --git a/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl b/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl index 1489e5204..ba008c9b8 100644 --- a/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl +++ b/test/integration/eu-west-1/k8s-qa/cluster/terragrunt.hcl @@ -67,10 +67,6 @@ inputs = { ami_id = "ami-0275aedb4db249683" availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] max_unavailable_percentage = 50 - kube_memory = "1024Mi" - kube_cpu = "500m" - sys_memory = "768Mi" - sys_cpu = "300m" labels = { "karpenter.sh/controller" = "true" # required for Karpenter } @@ -93,10 +89,6 @@ inputs = { labels = { dedicated = "observability" } - kube_memory = "585Mi" - kube_cpu = "90m" - sys_memory = "585Mi" - sys_cpu = "90m" } } From 76d1d5accdba23da1d27542b2ddea6661bd771d0 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Fri, 19 Jun 2026 09:01:08 +0200 Subject: [PATCH 07/14] Fix max_pods to upper limit recommended by Kubernetes docs Signed-off-by: Willi Carlsen --- .../eks-nodegroup-managed/dependencies.tf | 4 ++++ _sub/compute/eks-nodegroup-managed/main.tf | 4 ++-- .../eks-nodegroup-managed/user-data.sh.tftpl | 22 +++++++++---------- _sub/compute/eks-nodegroup-managed/vars.tf | 6 ----- compute/eks-ec2/main.tf | 1 - compute/eks-ec2/vars.tf | 1 - 6 files changed, 17 insertions(+), 21 deletions(-) diff --git a/_sub/compute/eks-nodegroup-managed/dependencies.tf b/_sub/compute/eks-nodegroup-managed/dependencies.tf index ed2999a5e..bef0a13b3 100644 --- a/_sub/compute/eks-nodegroup-managed/dependencies.tf +++ b/_sub/compute/eks-nodegroup-managed/dependencies.tf @@ -18,4 +18,8 @@ data "aws_ami" "eks-node" { locals { # Pins AMI to 'ami_id' if it is set, otherwise, sets to the latest AMI. node_ami = var.ami_id != "" ? var.ami_id : data.aws_ami.eks-node.id +} + +locals { + max_pod = 110 } \ No newline at end of file diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 26c93f867..21410ba66 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -13,9 +13,9 @@ resource "aws_launch_template" "eks" { cluster_name : var.cluster_name, worker_inotify_max_user_watches : var.worker_inotify_max_user_watches, cidr : var.eks_service_cidr, - max_pods : var.max_pods, + max_pods : local.max_pods, docker_hub_creds : var.docker_hub_creds_ssm_path, - kubelet_memory_reservation : "${tostring(ceil(255 + (11 * var.max_pods)))}Mi" + kubelet_memory_reservation : "${tostring(ceil(255 + (11 * local.max_pods)))}Mi" })) key_name = var.ec2_ssh_key update_default_version = true diff --git a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl index 94f85bc35..d79c42a89 100644 --- a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl +++ b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl @@ -29,16 +29,16 @@ Content-Type: application/node.eks.aws apiVersion: node.eks.aws/v1alpha1 kind: NodeConfig spec: - cluster: - name: ${cluster_name} - apiServerEndpoint: ${eks_endpoint} - certificateAuthority: ${eks_certificate_authority} - cidr: ${cidr} - kubelet: - config: - maxPods: ${max_pods} - registryPullQPS: 0 - kubeReserved: - memory: ${kubelet_memory_reservation} + cluster: + name: ${cluster_name} + apiServerEndpoint: ${eks_endpoint} + certificateAuthority: ${eks_certificate_authority} + cidr: ${cidr} + kubelet: + config: + maxPods: ${max_pods} + registryPullQPS: 0 + kubeReserved: + memory: ${kubelet_memory_reservation} --BOUNDARY-- diff --git a/_sub/compute/eks-nodegroup-managed/vars.tf b/_sub/compute/eks-nodegroup-managed/vars.tf index 810829378..08a1fb772 100644 --- a/_sub/compute/eks-nodegroup-managed/vars.tf +++ b/_sub/compute/eks-nodegroup-managed/vars.tf @@ -113,10 +113,4 @@ variable "max_unavailable_percentage" { type = number description = "Desired max percentage of unavailable worker nodes during node group update." default = null -} - -variable "max_pods" { - type = number - description = "Maximum number of Pods that can run on the Kubelet" - default = 110 } \ No newline at end of file diff --git a/compute/eks-ec2/main.tf b/compute/eks-ec2/main.tf index f9e446c4c..7d22e60f8 100644 --- a/compute/eks-ec2/main.tf +++ b/compute/eks-ec2/main.tf @@ -270,7 +270,6 @@ module "eks_managed_workers_node_group" { subnet_ids = length(each.value.availability_zones) == 0 ? module.eks_managed_workers_subnet.subnet_ids : [ for sn in module.eks_managed_workers_subnet.subnets : sn.id if contains(each.value.availability_zones, sn.availability_zone) ] - max_pods = each.value.max_pods # Docker Hub credentials docker_hub_creds_ssm_path = aws_ssm_parameter.dockerhub.name diff --git a/compute/eks-ec2/vars.tf b/compute/eks-ec2/vars.tf index 3b1e7c74d..9b42074e9 100644 --- a/compute/eks-ec2/vars.tf +++ b/compute/eks-ec2/vars.tf @@ -193,7 +193,6 @@ variable "eks_managed_nodegroups" { effect = string })), []) labels = optional(map(string), {}) - max_pods = optional(number, 110) })) default = {} validation { From 98d333a41f12142ab05f99448c239948f69ea97d Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Fri, 19 Jun 2026 09:55:07 +0200 Subject: [PATCH 08/14] Fix typo for max_pod -> max_pods Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/dependencies.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_sub/compute/eks-nodegroup-managed/dependencies.tf b/_sub/compute/eks-nodegroup-managed/dependencies.tf index bef0a13b3..97a9505f8 100644 --- a/_sub/compute/eks-nodegroup-managed/dependencies.tf +++ b/_sub/compute/eks-nodegroup-managed/dependencies.tf @@ -21,5 +21,5 @@ locals { } locals { - max_pod = 110 + max_pods = 110 } \ No newline at end of file From 1d9b68b0e9d80174cf2c9a5ec6c6a010f3a1deb8 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Sat, 20 Jun 2026 19:11:18 +0200 Subject: [PATCH 09/14] Added systemReserved.memory=200Mi, since it is essential to the nodes Ready state under extreme CPU and memory pressure Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/user-data.sh.tftpl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl index d79c42a89..92650d982 100644 --- a/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl +++ b/_sub/compute/eks-nodegroup-managed/user-data.sh.tftpl @@ -40,5 +40,7 @@ spec: registryPullQPS: 0 kubeReserved: memory: ${kubelet_memory_reservation} + systemReserved: + memory: 200Mi --BOUNDARY-- From 04afcbb1a353f88fcbd5351284e564fb8dd61836 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Tue, 23 Jun 2026 14:54:14 +0200 Subject: [PATCH 10/14] Add warning with check block if instance_type is too small to support max_pods of 110 and stop setting instance_types on launch_template Signed-off-by: Willi Carlsen --- .../eks-nodegroup-managed/dependencies.tf | 24 ++++++++++++++++++- _sub/compute/eks-nodegroup-managed/main.tf | 2 +- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/_sub/compute/eks-nodegroup-managed/dependencies.tf b/_sub/compute/eks-nodegroup-managed/dependencies.tf index 97a9505f8..65384e147 100644 --- a/_sub/compute/eks-nodegroup-managed/dependencies.tf +++ b/_sub/compute/eks-nodegroup-managed/dependencies.tf @@ -22,4 +22,26 @@ locals { locals { max_pods = 110 -} \ No newline at end of file +} + +data "aws_ec2_instance_type" "this" { + for_each = toset(var.instance_types) + instance_type = each.value +} + +locals { + max_pods_calc = { + for instance_type, instance_data in data.aws_ec2_instance_type.this : instance_type => ( + (instance_data.maximum_network_interfaces * ((instance_data.maximum_ipv4_addresses_per_interface - 1) * 16)) + 2 + ) + } +} + +check "instance_types_support_max_pods" { + assert { + condition = alltrue([for instance_type, instance_data in local.max_pods_calc : ( + instance_data >= local.max_pods + )]) + error_message = "One or more instance types is too small and does not support the required max pods of ${local.max_pods}." + } +} diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 21410ba66..7ea13d7ef 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -3,7 +3,7 @@ resource "aws_launch_template" "eks" { count = signum(var.desired_size_per_subnet) image_id = local.node_ami - instance_type = element(var.instance_types, 0) + instance_type = null # because instance_type is a list set on node groups name_prefix = "eks-${var.cluster_name}-${var.nodegroup_name}-" # Make sure to update the max pod values in the template below using the script # `src/produce-eni-max-pods.sh` when updating the EKS VPC CNI addon. From 99c424fb86553a1e8e1f1e475fc70de5c14d4ac7 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Tue, 23 Jun 2026 20:48:58 +0200 Subject: [PATCH 11/14] Add instance_type to aws_eks_node_group resource in stead of launch_template Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/main.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 7ea13d7ef..28d0d3d63 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -50,6 +50,7 @@ resource "aws_eks_node_group" "group" { node_group_name = var.nodegroup_name node_role_arn = var.node_role_arn subnet_ids = var.subnet_ids + instance_types = var.instance_types capacity_type = var.use_spot_instances ? "SPOT" : "ON_DEMAND" dynamic "taint" { From 01872f83acd51ccfe0b37bd5875b2dbc279bcf43 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Mon, 29 Jun 2026 13:32:10 +0200 Subject: [PATCH 12/14] Nodegroups should create before destroy Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/main.tf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 28d0d3d63..22c097444 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -88,6 +88,10 @@ resource "aws_eks_node_group" "group" { max_size = local.asg_max_size min_size = local.asg_min_size } + + lifecycle { + create_before_destroy = true + } } resource "aws_autoscaling_schedule" "eks" { From 1ddca3d0b9614377f02522c68d064924c209f0aa Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Mon, 29 Jun 2026 13:34:02 +0200 Subject: [PATCH 13/14] Launch template should also create before destroy Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/main.tf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 22c097444..42825a686 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -42,6 +42,10 @@ resource "aws_launch_template" "eks" { monitoring { enabled = true } + + lifecycle { + create_before_destroy = true + } } resource "aws_eks_node_group" "group" { From 4175cc6a33c189182d5a372942cc23c89e9fbd99 Mon Sep 17 00:00:00 2001 From: Willi Carlsen Date: Mon, 29 Jun 2026 14:08:02 +0200 Subject: [PATCH 14/14] Use node_group_name_prefix to allow create before destroy Signed-off-by: Willi Carlsen --- _sub/compute/eks-nodegroup-managed/main.tf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/_sub/compute/eks-nodegroup-managed/main.tf b/_sub/compute/eks-nodegroup-managed/main.tf index 42825a686..bde7fb1c6 100644 --- a/_sub/compute/eks-nodegroup-managed/main.tf +++ b/_sub/compute/eks-nodegroup-managed/main.tf @@ -51,7 +51,8 @@ resource "aws_launch_template" "eks" { resource "aws_eks_node_group" "group" { count = signum(var.desired_size_per_subnet) cluster_name = var.cluster_name - node_group_name = var.nodegroup_name + node_group_name = null # conflicts with node_group_name_prefix + node_group_name_prefix = "${var.nodegroup_name}-" # needed for create before destroy lifecycle node_role_arn = var.node_role_arn subnet_ids = var.subnet_ids instance_types = var.instance_types