Enabling Karpenter on EKS with Terraform: What It Is, Why It's Worth It, and How to Set It Up

Karpenter is a tool that replaces the traditional way of managing EC2 instance types and Cluster Autoscaler in Amazon EKS (Elastic Kubernetes Service). Instead of guessing instance types and setting min/max values, Karpenter watches for pods that can't be scheduled and launches the exact EC2 capacity needed. This guide explains how Karpenter works, its benefits, and the Terraform configuration required to set it up on EKS.

Prerequisites for setting up Karpenter include a running Amazon EKS cluster, Terraform version 1.11 or higher, an existing VPC and subnets, an existing security group, Helm version 3+, kubectl configured to access the EKS cluster, and AWS CLI with credentials configured.

Karpenter works by collapsing the two traditional autoscaling layers (Kubernetes scheduler and Cluster Autoscaler) into one loop. When a pod goes Pending, Karpenter assesses its requirements (CPU, memory, architecture, zone, GPU, etc.) and selects the cheapest EC2 instance type that meets those requirements. It then launches the instance directly using the EC2 Fleet API.

Karpenter continuously monitors for empty or underutilized nodes and consolidates workloads to shut them down, eliminating the need for an ASG in the loop. It communicates directly with EC2, enabling faster scaling and a more extensive range of instance types compared to hand-picked node groups.

The benefits of using Karpenter include right-sized capacity every time, faster scaling, less management overhead, safer use of Spot instances, and self-healing infrastructure. Cost-effective strategies implemented by Karpenter include Spot-first, mixed with On-Demand, consolidation when nodes are underutilized, broad instance selection, and scheduled node expiry with automatic AMI patching.

To set up Karpenter on EKS, you need to create IAM roles for the controller pod and EC2 instances it creates. The controller role is trusted by an OIDC provider (IRSA) and scoped to the Karpenter service account. The node role is trusted by EC2 and attached to every launched node. After configuring IAM roles, you enable Spot instances, set consolidation policies, define instance selection, and configure scheduled node expiry in Terraform.