Skip to content

Commit

Permalink
Update AWS Provisioner docs w/ proper tag examples (#1402)
Browse files Browse the repository at this point in the history
* update AWS Provisioner docs w/ proper tag examples

* perma link to version

* use main instead of preview for github link

* add githubRelRef shortcode
  • Loading branch information
bwagner5 committed Feb 24, 2022
1 parent f4320b4 commit b6faf59
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 11 deletions.
17 changes: 8 additions & 9 deletions website/content/en/preview/AWS/provisioning.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ weight: 10

This section covers parameters of the AWS Cloud Provider.

[Review these fields in the code.](https://github.com/awslabs/karpenter/blob/main/pkg/cloudprovider/aws/apis/v1alpha1/provider.go#L33)
[Review these fields in the code.](https://github.com/aws/karpenter/blob{{< githubRelRef >}}pkg/cloudprovider/aws/apis/v1alpha1/provider.go)

### InstanceProfile
An `InstanceProfile` is a way to pass a single IAM role to an EC2 instance. Karpenter will not create one automatically.
Expand Down Expand Up @@ -48,13 +48,13 @@ When launching nodes, Karpenter automatically chooses a subnet that matches the
Select all subnets with a specified tag:
```
subnetSelector:
kubernetes.io/cluster/MyCluster: '*'
karpenter.sh/discovery/MyClusterName: '*'
```

Select subnets by name:
```
subnetSelector:
Name: subnet-0fcd7006b3754e95e
Name: my-subnet
```

Select subnets by an arbitrary AWS tag key/value pair:
Expand All @@ -73,19 +73,18 @@ Select subnets using wildcards:
### SecurityGroupSelector

The security group of an instance is comparable to a set of firewall rules.
If no security groups are explicitly listed, Karpenter discovers them using the tag "kubernetes.io/cluster/MyClusterName", similar to subnet discovery.

EKS creates at least two security groups by default, [review the documentation](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html) for more info.

Security groups may be specified by any AWS tag, including "name". Selecting tags using wildcards ("*") is supported.
Security groups may be specified by any AWS tag, including "Name". Selecting tags using wildcards ("*") is supported.

‼️ When launching nodes, Karpenter uses all of the security groups that match the selector. If multiple security groups with the tag `kubernetes.io/cluster/MyClusterName` match the selector, this may result in failures using the AWS Load Balancer controller. The Load Balancer controller only supports a single security group having that tag key. See this [issue](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2367) for more details.
‼️ When launching nodes, Karpenter uses all of the security groups that match the selector. If multiple security groups with the tag `karpenter.sh/discovery/MyClusterName` match the selector, this may result in failures using the AWS Load Balancer controller. The Load Balancer controller only supports a single security group having that tag key. See this [issue](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2367) for more details.

To verify if this restriction affects you, run the following commands.
```bash
CLUSTER_VPC_ID="$(aws eks describe-cluster --name $CLUSTER_NAME --query cluster.resourcesVpcConfig.vpcId --output text)"

aws ec2 describe-security-groups --filters Name=vpc-id,Values=$CLUSTER_VPC_ID Name=tag-key,Values=kubernetes.io/cluster/$CLUSTER_NAME --query 'SecurityGroups[].[GroupName]' --output text
aws ec2 describe-security-groups --filters Name=vpc-id,Values=$CLUSTER_VPC_ID Name=tag-key,Values=karpenter.sh/discovery/$CLUSTER_NAME --query 'SecurityGroups[].[GroupName]' --output text
```

If multiple securityGroups are printed, you will need a more targeted securityGroupSelector.
Expand All @@ -97,13 +96,13 @@ Select all security groups with a specified tag:
spec:
provider:
securityGroupSelector:
kubernetes.io/cluster/MyKarpenterSecurityGroups: '*'
karpenter.sh/discovery/MyClusterName: '*'
```

Select security groups by name, or another tag (all criteria must match):
```
securityGroupSelector:
Name: sg-01077157b7cf4f5a8
Name: my-security-group
MySecurityTag: '' # matches all resources with the tag
```

Expand Down
4 changes: 2 additions & 2 deletions website/content/en/preview/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ See [Cloud provider]({{< ref "./concepts/#cloud-provider" >}}) for details.

### Can I write my own cloud provider for Karpenter?
Yes, but there is no documentation yet for it.
Start with Karpenter's GitHub [cloudprovider](https://github.com/aws/karpenter/tree/main/pkg/cloudprovider) documentation to see how the AWS provider is built, but there are other sections of the code that will require changes too.
Start with Karpenter's GitHub [cloudprovider](https://github.com/aws/karpenter/tree{{< githubRelRef >}}pkg/cloudprovider) documentation to see how the AWS provider is built, but there are other sections of the code that will require changes too.

### What operating system nodes does Karpenter deploy?
By default, Karpenter uses Amazon Linux 2 images.
Expand All @@ -29,7 +29,7 @@ Specify the desired architecture when you deploy workloads.

### What RBAC access is required?
All of the required RBAC rules can be found in the helm chart template.
See [clusterrolebinding.yaml](https://github.com/aws/karpenter/blob/main/charts/karpenter/templates/clusterrolebinding.yaml), [clusterrole.yaml](https://github.com/aws/karpenter/blob/main/charts/karpenter/templates/clusterrole.yaml), [rolebinding.yaml](https://github.com/aws/karpenter/blob/main/charts/karpenter/templates/rolebinding.yaml), and [role.yaml](https://github.com/aws/karpenter/blob/main/charts/karpenter/templates/role.yaml) files for details.
See [clusterrolebinding.yaml](https://github.com/aws/karpenter/blob{{< githubRelRef >}}charts/karpenter/templates/clusterrolebinding.yaml), [clusterrole.yaml](https://github.com/aws/karpenter/blob{{< githubRelRef >}}charts/karpenter/templates/clusterrole.yaml), [rolebinding.yaml](https://github.com/aws/karpenter/blob{{< githubRelRef >}}charts/karpenter/templates/rolebinding.yaml), and [role.yaml](https://github.com/aws/karpenter/blob{{< githubRelRef >}}charts/karpenter/templates/role.yaml) files for details.

### Can I run Karpenter outside of a Kubernetes cluster?
Yes, as long as the controller has network and IAM/RBAC access to the Kubernetes API and your provider API.
Expand Down
1 change: 1 addition & 0 deletions website/layouts/shortcodes/githubRelRef.html
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
/{{ replace (chomp (delimit (first 2 (split .Page.RelPermalink "/")) "" "")) "preview" .Page.Site.Params.github_branch }}/

0 comments on commit b6faf59

Please sign in to comment.