Karpenter NodePool and EC2NodeClass generator

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: default
spec:
  template:
    spec:
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: default
      requirements:
        - key: kubernetes.io/arch
          operator: In
          values: ["amd64", "arm64"]
        - key: kubernetes.io/os
          operator: In
          values: ["linux"]
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["on-demand", "spot"]
        - key: karpenter.k8s.aws/instance-category
          operator: In
          values: ["c", "m", "r"]
        - key: karpenter.k8s.aws/instance-generation
          operator: Gt
          values: ["4"]
      expireAfter: 720h
  limits:
    cpu: "1000"
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized
    consolidateAfter: 1m
    budgets:
      - nodes: "10%"
---
apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: default
spec:
  role: "KarpenterNodeRole-my-cluster"
  amiSelectorTerms:
    - alias: al2023@latest
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: "my-cluster"
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: "my-cluster"
  blockDeviceMappings:
    - deviceName: /dev/xvda
      ebs:
        volumeSize: 50Gi
        volumeType: gp3
        encrypted: true
  metadataOptions:
    httpTokens: required
    httpPutResponseHopLimit: 1

Before you apply

• arm64 (Graviton) needs multi-arch images. Make sure your containers have an arm64 manifest before you roll it out.
• The @latest alias updates AMIs on its own and triggers drift. In production, pin a version (for example al2023@v20250101) and promote it in a controlled way.

What this YAML assumes

• Karpenter v1 (karpenter.sh/v1 and karpenter.k8s.aws/v1 APIs), installed and running in the cluster.
• The node role is named KarpenterNodeRole-<cluster>, and subnets and security groups carry the karpenter.sh/discovery tag with the cluster name. Adjust it if your convention differs.
• The NodePool and the EC2NodeClass share a name, and nodes require IMDSv2 (httpTokens: required) with an encrypted gp3 disk.
• This is a starting point: validate it in staging, with PodDisruptionBudgets and CPU and memory requests set on your workloads.

Want me to review your Karpenter setup?

In an assessment I look at NodePools, Spot, consolidation and the real cost of your cluster, and deliver a prioritized plan.