Skip to content

Commit f242c8f

Browse files
authored
feat: capacity block support (#8011)
1 parent 1c1041f commit f242c8f

35 files changed

+1377
-186
lines changed

charts/karpenter-crd/templates/karpenter.k8s.aws_ec2nodeclasses.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -721,6 +721,22 @@ spec:
721721
description: The ID of the AWS account that owns the capacity reservation.
722722
pattern: ^[0-9]{12}$
723723
type: string
724+
reservationType:
725+
default: default
726+
description: The type of capacity reservation.
727+
enum:
728+
- default
729+
- capacity-block
730+
type: string
731+
state:
732+
default: active
733+
description: |-
734+
The state of the capacity reservation. A capacity reservation is considered to be expiring if it is within the EC2
735+
reclaimation window. Only capacity-block reservations may be in this state.
736+
enum:
737+
- active
738+
- expiring
739+
type: string
724740
required:
725741
- availabilityZone
726742
- id

charts/karpenter-crd/templates/karpenter.sh_nodeclaims.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ spec:
141141
- message: label "kubernetes.io/hostname" is restricted
142142
rule: self != "kubernetes.io/hostname"
143143
- message: label domain "karpenter.k8s.aws" is restricted
144-
rule: self in ["karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
144+
rule: self in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
145145
minValues:
146146
description: |-
147147
This field is ALPHA and can be dropped or replaced at any time

charts/karpenter-crd/templates/karpenter.sh_nodepools.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ spec:
210210
- message: label "kubernetes.io/hostname" is restricted
211211
rule: self.all(x, x != "kubernetes.io/hostname")
212212
- message: label domain "karpenter.k8s.aws" is restricted
213-
rule: self.all(x, x in ["karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws"))
213+
rule: self.all(x, x in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws"))
214214
type: object
215215
spec:
216216
description: |-
@@ -283,7 +283,7 @@ spec:
283283
- message: label "kubernetes.io/hostname" is restricted
284284
rule: self != "kubernetes.io/hostname"
285285
- message: label domain "karpenter.k8s.aws" is restricted
286-
rule: self in ["karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
286+
rule: self in ["karpenter.k8s.aws/capacity-reservation-type", "karpenter.k8s.aws/capacity-reservation-id", "karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws")
287287
minValues:
288288
description: |-
289289
This field is ALPHA and can be dropped or replaced at any time

designs/capacity-block-support.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# Capacity Block Support
2+
3+
## Overview
4+
5+
In v1.3.0 Karpenter introduced formal support for on-demand capacity reservations.
6+
However, this did not include a subset of ODCRs: Capacity Blocks.
7+
Capacity Blocks enable users to “reserve highly sought-after GPU instances on a future date to support short duration ML workloads”.
8+
This doc will focus on the extension to Karpenter’s existing ODCR feature to support Capacity Blocks.
9+
10+
## Goals
11+
12+
- Karpenter should enable users to select against Capacity Blocks when scheduling workloads
13+
- Karpenter should discover Capacity Blocks through `ec2nodeclass.spec.capacityReservationSelectorTerms`
14+
- Karpenter should gracefully handle Capacity Block expiration
15+
16+
## API Updates
17+
18+
We will add the `karpenter.k8s.aws/capacity-reservation-type` label, which can take on the values `default` and `capacity-block`.
19+
This mirrors the `reservationType` field in the `ec2:DescribeCapacityReservation` response and will enable users to select on capacity block nodes via NodePool requirements or node selector terms.
20+
21+
```yaml
22+
# Configure a NodePool to only be compatible with instance types with active
23+
# capacity block reservations
24+
kind: NodePool
25+
apiVersion: karpenter.sh/v1
26+
spec:
27+
template:
28+
spec:
29+
requirements:
30+
- key: karpenter.k8s.aws/capacity-reservation-type
31+
operator: In
32+
values: ['capacity-block']
33+
---
34+
# Configure a pod to only schedule against nodes backed by capacity blocks
35+
kind: Pod
36+
apiVersion: v1
37+
spec:
38+
nodeSelector:
39+
karpenter.k8s.aws/capacity-reservation-type: capacity-block
40+
```
41+
42+
Additionally, we will update the NodeClass status to reflect the reservation type and state for a given capacity reservation:
43+
44+
```yaml
45+
kind: EC2NodeClass
46+
apiVersion: karpenter.k8s.aws/v1
47+
status:
48+
capacityReservations:
49+
- # ...
50+
reservationType: Enum (default | capacity-block)
51+
state: Enum (active | expiring)
52+
```
53+
54+
No changes are required for `ec2nodeclass.spec.capacityReservationSelectorTerms`.
55+
56+
## Launch Behavior
57+
58+
Today, when Karpenter creates a NodeClaim targeting reserved capacity, it ensures it is launched into one of the correct reservations by injecting a `karpenter.k8s.aws/capacity-reservation-id` requirement into the NodeClaim.
59+
By injecting this requirement, we ensure Karpenter can maximize flexibility sent to CreateFleet (minimizing risk of ReservedCapacityExceeded errors) while also ensuring Karpenter doesn’t overlaunch into any given reservation.
60+
61+
```yaml
62+
kind: NodeClaim
63+
apiVersion: karpenter.sh/v1
64+
spec:
65+
requirements:
66+
- key: karpenter.k8s.aws/capacity-reservation-id
67+
operator: In
68+
values: ['cr-foo', 'cr-bar']
69+
# ...
70+
```
71+
72+
Given the NodeClaim spec above, Karpenter will create launch templates for both `cr-foo` and `cr-bar`, providing both in the CreateFleet request.
73+
However, this breaks down when we begin to mix default and capacity-block ODCRs (e.g. `cr-foo` is a default capacity reservation, and `cr-bar` is a capacity-block).
74+
This is because the `TargetCapacitySpecificationRequest.DefaultTargetCapacityType` field in the CreateFleet request needs to be set to on-demand or capacity-block, preventing us from mixing them in a single request.
75+
Instead, if a NodeClaim is compatible with both types of ODCRs, we must choose a subset of those ODCRs to include in the CreateFleet request.
76+
We have the following options for prioritization when making this selection:
77+
78+
- Prioritize price (the subset with the “cheapest” offering)
79+
- Prioritize flexibility (the subset with the greatest number of offerings)
80+
81+
Although prioritizing flexibility is desireable to reduce the risk of ReservedCapacityExceeded errors, it won’t interact well with consolidation and result in additional node churn.
82+
For that reason, we should prioritize the set of ODCRs with the “cheapest” offering when generating the CreateFleet request.
83+
If there is a tie between a default and capacity-block offering, we will prioritize the capacity-block offering.
84+
85+
## Interruption
86+
87+
Although capacity blocks are modeled as ODCRs, their expiration behavior differs.
88+
Any capacity still in use when a default ODCR expires falls back to a standard on-demand instance.
89+
On the other hand, instances in use from a capacity block reservation are terminated ahead of their end date.
90+
91+
From the [EC2 documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-capacity-blocks.html):
92+
93+
> You can use all the instances you reserved until 30 minutes before the end time of the Capacity Block.
94+
> With 30 minutes left in your Capacity Block reservation, we begin terminating any instances that are running in the Capacity Block.
95+
> We use this time to clean up your instances before delivering the Capacity Block to the next customer.
96+
> We emit an event through EventBridge 10 minutes before the termination process begins.
97+
> For more information, see Monitor Capacity Blocks using EventBridge.
98+
99+
Karpenter should gracefully handle this interruption by draining the nodes ahead of termination.
100+
While we could integrate with the EventBridge event referenced above, this introduces complications when rehydrating state after a controller restart.
101+
Instead, we will rely on the fact that interruption occurs at a fixed time relative to the end date of the capacity reservation, which is already discovered via `ec2:DescribeCapacityReservation`.
102+
Matching the time the expiration warning event is emmitted, Karpenter will begin to drain the node 10 minutes before EC2 begins reclaiming the capacity (40 minutes before the end date).
103+
Once the reclaimation period begins, Karpenter will mark the capacity reservation as expiring in the EC2NodeClass' status.

hack/validation/labels.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
function injectDomainLabelRestrictions() {
44
domain=$1
5-
rule="self.all(x, x in [\"${domain}/capacity-reservation-id\", \"${domain}/ec2nodeclass\", \"${domain}/instance-encryption-in-transit-supported\", \"${domain}/instance-category\", \"${domain}/instance-hypervisor\", \"${domain}/instance-family\", \"${domain}/instance-generation\", \"${domain}/instance-local-nvme\", \"${domain}/instance-size\", \"${domain}/instance-cpu\", \"${domain}/instance-cpu-manufacturer\", \"${domain}/instance-cpu-sustained-clock-speed-mhz\", \"${domain}/instance-memory\", \"${domain}/instance-ebs-bandwidth\", \"${domain}/instance-network-bandwidth\", \"${domain}/instance-gpu-name\", \"${domain}/instance-gpu-manufacturer\", \"${domain}/instance-gpu-count\", \"${domain}/instance-gpu-memory\", \"${domain}/instance-accelerator-name\", \"${domain}/instance-accelerator-manufacturer\", \"${domain}/instance-accelerator-count\"] || !x.find(\"^([^/]+)\").endsWith(\"${domain}\"))"
5+
rule="self.all(x, x in [\"${domain}/capacity-reservation-type\", \"${domain}/capacity-reservation-id\", \"${domain}/ec2nodeclass\", \"${domain}/instance-encryption-in-transit-supported\", \"${domain}/instance-category\", \"${domain}/instance-hypervisor\", \"${domain}/instance-family\", \"${domain}/instance-generation\", \"${domain}/instance-local-nvme\", \"${domain}/instance-size\", \"${domain}/instance-cpu\", \"${domain}/instance-cpu-manufacturer\", \"${domain}/instance-cpu-sustained-clock-speed-mhz\", \"${domain}/instance-memory\", \"${domain}/instance-ebs-bandwidth\", \"${domain}/instance-network-bandwidth\", \"${domain}/instance-gpu-name\", \"${domain}/instance-gpu-manufacturer\", \"${domain}/instance-gpu-count\", \"${domain}/instance-gpu-memory\", \"${domain}/instance-accelerator-name\", \"${domain}/instance-accelerator-manufacturer\", \"${domain}/instance-accelerator-count\"] || !x.find(\"^([^/]+)\").endsWith(\"${domain}\"))"
66
message="label domain \"${domain}\" is restricted"
77
MSG="${message}" RULE="${rule}" yq eval '.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.template.properties.metadata.properties.labels.x-kubernetes-validations += [{"message": strenv(MSG), "rule": strenv(RULE)}]' -i pkg/apis/crds/karpenter.sh_nodepools.yaml
88
}

hack/validation/requirements.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
function injectDomainRequirementRestrictions() {
44
domain=$1
5-
rule="self in [\"${domain}/capacity-reservation-id\", \"${domain}/ec2nodeclass\", \"${domain}/instance-encryption-in-transit-supported\", \"${domain}/instance-category\", \"${domain}/instance-hypervisor\", \"${domain}/instance-family\", \"${domain}/instance-generation\", \"${domain}/instance-local-nvme\", \"${domain}/instance-size\", \"${domain}/instance-cpu\", \"${domain}/instance-cpu-manufacturer\", \"${domain}/instance-cpu-sustained-clock-speed-mhz\", \"${domain}/instance-memory\", \"${domain}/instance-ebs-bandwidth\", \"${domain}/instance-network-bandwidth\", \"${domain}/instance-gpu-name\", \"${domain}/instance-gpu-manufacturer\", \"${domain}/instance-gpu-count\", \"${domain}/instance-gpu-memory\", \"${domain}/instance-accelerator-name\", \"${domain}/instance-accelerator-manufacturer\", \"${domain}/instance-accelerator-count\"] || !self.find(\"^([^/]+)\").endsWith(\"${domain}\")"
5+
rule="self in [\"${domain}/capacity-reservation-type\", \"${domain}/capacity-reservation-id\", \"${domain}/ec2nodeclass\", \"${domain}/instance-encryption-in-transit-supported\", \"${domain}/instance-category\", \"${domain}/instance-hypervisor\", \"${domain}/instance-family\", \"${domain}/instance-generation\", \"${domain}/instance-local-nvme\", \"${domain}/instance-size\", \"${domain}/instance-cpu\", \"${domain}/instance-cpu-manufacturer\", \"${domain}/instance-cpu-sustained-clock-speed-mhz\", \"${domain}/instance-memory\", \"${domain}/instance-ebs-bandwidth\", \"${domain}/instance-network-bandwidth\", \"${domain}/instance-gpu-name\", \"${domain}/instance-gpu-manufacturer\", \"${domain}/instance-gpu-count\", \"${domain}/instance-gpu-memory\", \"${domain}/instance-accelerator-name\", \"${domain}/instance-accelerator-manufacturer\", \"${domain}/instance-accelerator-count\"] || !self.find(\"^([^/]+)\").endsWith(\"${domain}\")"
66
message="label domain \"${domain}\" is restricted"
77
MSG="${message}" RULE="${rule}" yq eval '.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.requirements.items.properties.key.x-kubernetes-validations += [{"message": strenv(MSG), "rule": strenv(RULE)}]' -i pkg/apis/crds/karpenter.sh_nodeclaims.yaml
88
MSG="${message}" RULE="${rule}" yq eval '.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.template.properties.spec.properties.requirements.items.properties.key.x-kubernetes-validations += [{"message": strenv(MSG), "rule": strenv(RULE)}]' -i pkg/apis/crds/karpenter.sh_nodepools.yaml

0 commit comments

Comments
 (0)