Skip to content

NO-JIRA: chore(karpenter): bump karpenter-provider-aws vendor and sync CRDs - #9109

Closed
jhjaggars wants to merge 2 commits into
openshift:mainfrom
jhjaggars:sync-karpenter-ec2nodeclass-crd
Closed

NO-JIRA: chore(karpenter): bump karpenter-provider-aws vendor and sync CRDs#9109
jhjaggars wants to merge 2 commits into
openshift:mainfrom
jhjaggars:sync-karpenter-ec2nodeclass-crd

Conversation

@jhjaggars

@jhjaggars jhjaggars commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

Bumps the karpenter-provider-aws vendor to openshift/aws-karpenter-provider-aws at commit
abcf7d1e3417 (release-5.0 head) and runs make karpenter-api to sync the CRDs with
OpenShift-specific CEL relaxations applied.

The karpenter-provider-aws binary in the 5.0 payload includes several new features that
require both Go type and CRD schema updates:

  • connectionTracking: configures idle connection tracking timeouts on ENIs
  • cpuOptions.nestedVirtualization: enables nested virtualization filtering for instance types
  • networkInterfaces: specifies network interface configurations for provisioned instances
  • placementGroupSelector: defines placement group selection by name or id
  • Capacity reservation interruptible status field
  • Updated karpenter core types (NodeClaim, NodePool, NodeOverlay CRDs)

Dependency changes

Dependency Old New
karpenter-provider-aws (replace) f0be9c72e5bf (2026-03-11) abcf7d1e3417 (2026-07-22)
karpenter (replace) 67e201b559d5 (2026-03-10) 2b8ed744bf1c (2026-07-21)
operatorpkg 2025-12-22 2026-05-01
samber/lo v1.52.0 v1.53.0
aws-sdk-go-v2/service/eks v1.77.0 v1.84.5
k8s.io/* v0.35.1 v0.35.3
controller-runtime v0.22.5 v0.22.5 (pinned via replace)

Controller-runtime is pinned at v0.22.5 because v0.23.x changes the NewWebhookManagedBy
signature, which would require bumping all vendored CAPI providers simultaneously.

Which issue(s) this PR fixes:

Special notes for your reviewer:

The CRD file (karpenter.k8s.aws_ec2nodeclasses.yaml) is produced by make karpenter-api,
which copies the CRD from the vendor and applies OpenShift-specific CEL relaxations via
adjust-cel.sh. This is the standard karpenter CRD sync workflow.

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Summary by CodeRabbit

  • Maintenance
    • Updated underlying Kubernetes and cloud integration components to newer supported versions.
    • Refreshed infrastructure tooling and provider integrations for improved compatibility and reliability.
    • No user-facing features or interface changes were introduced.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 24, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@jhjaggars: This pull request explicitly references no jira issue.

Details

In response to this:

What this PR does / why we need it:

Syncs the EC2NodeClass CRD (karpenter.k8s.aws_ec2nodeclasses.yaml) from openshift/aws-karpenter-provider-aws at commit abcf7d1e3417 to match the version shipped in the OCP 5.0 payload.

The karpenter-provider-aws binary in the 5.0 payload includes several new features that require CRD schema updates:

  • cpuOptions.nestedVirtualization: enables nested virtualization filtering for instance types
  • connectionTracking: configures idle connection tracking timeouts on ENIs
  • networkInterfaces: specifies network interface configurations for provisioned instances
  • placementGroupSelector: defines placement group selection by name or id
  • Updated AMI selector term validation rules (relaxed from id-only to support tags/name/alias/ssmParameter with mutual exclusivity)
  • New AMI family enum values (AL2, AL2023, Bottlerocket, Windows2019, Windows2022, Windows2025)
  • Spec-level required fields (amiSelectorTerms, securityGroupSelectorTerms, subnetSelectorTerms) and 9 new CEL validation rules
  • Capacity reservation interruptible status field

Without this sync, the karpenter binary has the code to handle these features but the CRD rejects the API fields, making them unusable.

Notes for reviewers

  • Vendor Go types lag behind the CRD: The vendored Go types at vendor/github.com/aws/karpenter-provider-aws/pkg/apis/v1/ec2nodeclass.go do not include the 4 new struct fields (connectionTracking, cpuOptions, networkInterfaces, placementGroupSelector). This is expected — the CRD is synced ahead of the vendor to unblock the payload binary which already has the code. A vendor bump is a follow-up.

  • Schema tightening: required: []required: [amiSelectorTerms, securityGroupSelectorTerms, subnetSelectorTerms] and x-kubernetes-validations: [] → 9 CEL rules. This is technically a breaking schema change for any EC2NodeClass CRs stored without these fields. In practice, the controller always populates all three required fields and always sets role, so real-world impact is nil. Any manually-created EC2NodeClass objects missing these fields would become uneditable after the CRD update.

  • make generate will revert this file: Because the vendored Go types lack the new fields, running make generate regenerates the CRD from the old types and reverts the sync. This is expected — the CRD is intentionally ahead of the vendor. CI jobs that run make verify with the generate check will see a diff; this is a known characteristic of CRD-ahead-of-vendor syncs.

Which issue(s) this PR fixes:

Special notes for your reviewer:

The crd-schema-check in make verify may fail in worktree environments due to a go-git limitation with worktree git layouts — this is not related to the CRD changes.

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci openshift-ci Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/needs-area labels Jul 24, 2026
@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (4)
  • karpenter-operator/controllers/karpenter/assets/karpenter.k8s.aws_ec2nodeclasses.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • karpenter-operator/controllers/karpenter/assets/karpenter.sh_nodeclaims.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • karpenter-operator/controllers/karpenter/assets/karpenter.sh_nodeoverlays.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • karpenter-operator/controllers/karpenter/assets/karpenter.sh_nodepools.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e9c61606-7855-4756-b409-7f9e8cf3e78a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Updates Kubernetes modules from v0.35.1 to v0.35.3 in the root and API Go modules. The root module also updates controller-runtime and Karpenter requirements, refreshes AWS SDK, operatorpkg, and samber/lo dependencies, and changes OpenShift Karpenter replacement sources. A replacement directive pins controller-runtime to v0.22.5.

Possibly related PRs

Suggested reviewers: bryan-cox, muraee

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR only changes CRD YAML assets; no Go test files or Ginkgo titles were added or modified.
Test Structure And Quality ✅ Passed No Ginkgo test files were changed; this PR only updates CRD YAML and module/vendor files, so the test-quality check is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed Only CRD schema YAMLs changed; no deployment manifests, operator code, or controllers were modified, so this topology-scheduling check is not applicable.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the diff is CRD/dependency/vendor sync only, with no It/Describe/Context/When changes.
No-Weak-Crypto ✅ Passed Changed files only update Go deps and CRD YAML; scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges ✅ Passed PR only updates CRD YAMLs; no container/K8s manifest changes or privileged settings (privileged, hostNetwork, hostPID/IPC, SYS_ADMIN, allowPrivilegeEscalation) found.
No-Sensitive-Data-In-Logs ✅ Passed Only new log call is a V(1) info in volumeusage.go, logging pod/PVC/storageclass refs and an error; no secrets, tokens, PII, or customer data found.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main changes: updating the karpenter-provider-aws vendor and syncing CRDs.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci openshift-ci Bot added area/karpenter-operator Indicates the PR includes changes related to the Karpenter operator and removed do-not-merge/needs-area labels Jul 24, 2026
@jhjaggars

Copy link
Copy Markdown
Contributor Author

/pipeline required

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke
/test unit
/test verify

@codecov

codecov Bot commented Jul 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.56%. Comparing base (144cca9) to head (cdf8713).
⚠️ Report is 88 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #9109      +/-   ##
==========================================
+ Coverage   44.51%   44.56%   +0.04%     
==========================================
  Files         774      774              
  Lines       96997    97003       +6     
==========================================
+ Hits        43179    43228      +49     
+ Misses      50830    50783      -47     
- Partials     2988     2992       +4     

see 6 files with indirect coverage changes

Flag Coverage Δ
cmd-support 38.39% <ø> (ø)
cpo-hostedcontrolplane 47.22% <ø> (ø)
cpo-other 45.25% <ø> (ø)
hypershift-operator 54.46% <ø> (+0.01%) ⬆️
other 33.07% <ø> (+0.43%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…Shift forks

Bump the karpenter-provider-aws replace to openshift/aws-karpenter-provider-aws
at commit abcf7d1e3417 (release-5.0 head) and update the karpenter core
replace to the matching openshift/kubernetes-sigs-karpenter fork at
2b8ed744bf1c.

Pin controller-runtime to v0.22.5 to avoid a breaking API change in
v0.23.x (NewWebhookManagedBy signature) that would require bumping all
vendored CAPI providers simultaneously.

Transitive dependency updates pulled in by the bump:
- github.com/awslabs/operatorpkg 2025-12-22 → 2026-05-01
- github.com/samber/lo v1.52.0 → v1.53.0
- github.com/aws/aws-sdk-go-v2/service/eks v1.77.0 → v1.84.5
- k8s.io/api, k8s.io/apimachinery, k8s.io/client-go v0.35.1 → v0.35.3

Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
@jhjaggars
jhjaggars force-pushed the sync-karpenter-ec2nodeclass-crd branch from 22de8ad to 8026753 Compare July 24, 2026 22:26
@jhjaggars jhjaggars changed the title NO-JIRA: feat(karpenter): sync EC2NodeClass CRD from karpenter-provider-aws NO-JIRA: chore(karpenter): bump karpenter-provider-aws vendor and sync CRDs Jul 24, 2026
@openshift-ci

openshift-ci Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

@jhjaggars: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify 22de8ad link true /test verify

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci openshift-ci Bot added the area/api Indicates the PR includes changes for the API label Jul 24, 2026
@openshift-ci

openshift-ci Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jhjaggars
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Around line 128-129: Update the controller-runtime dependency configuration so
its effective version matches the Kubernetes module minor version: retain
v0.23.1 without a replacement, or consistently downgrade the k8s.io modules to
the supported v0.34 set for v0.22.5. Ensure the module graph no longer combines
controller-runtime v0.22.5 with Kubernetes v0.35.3.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 484bd44f-5976-4d25-95ee-aa05ed4c80ff

📥 Commits

Reviewing files that changed from the base of the PR and between 144cca9 and 8026753.

⛔ Files ignored due to path filters (128)
  • api/go.sum is excluded by !**/*.sum
  • api/vendor/modules.txt is excluded by !**/vendor/**
  • go.sum is excluded by !**/*.sum
  • karpenter-operator/controllers/karpenter/assets/karpenter.k8s.aws_ec2nodeclasses.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • karpenter-operator/controllers/karpenter/assets/karpenter.sh_nodeclaims.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • karpenter-operator/controllers/karpenter/assets/karpenter.sh_nodeoverlays.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • karpenter-operator/controllers/karpenter/assets/karpenter.sh_nodepools.yaml is excluded by !karpenter-operator/controllers/karpenter/assets/*.yaml
  • vendor/github.com/aws/aws-sdk-go-v2/internal/middleware/middleware.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/CHANGELOG.md is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_client.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_AssociateAccessPolicy.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_AssociateEncryptionConfig.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_AssociateIdentityProviderConfig.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateAccessEntry.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateAddon.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateCapability.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateCluster.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateEksAnywhereSubscription.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateFargateProfile.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreateNodegroup.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_CreatePodIdentityAssociation.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteAccessEntry.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteAddon.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteCapability.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteCluster.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteEksAnywhereSubscription.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteFargateProfile.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeleteNodegroup.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeletePodIdentityAssociation.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DeregisterCluster.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeAccessEntry.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeAddon.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeAddonConfiguration.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeAddonVersions.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeCapability.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeCluster.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeClusterVersions.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeEksAnywhereSubscription.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeFargateProfile.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeIdentityProviderConfig.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeInsight.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeInsightsRefresh.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeNodegroup.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribePodIdentityAssociation.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DescribeUpdate.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DisassociateAccessPolicy.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_DisassociateIdentityProviderConfig.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListAccessEntries.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListAccessPolicies.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListAddons.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListAssociatedAccessPolicies.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListCapabilities.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListClusters.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListEksAnywhereSubscriptions.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListFargateProfiles.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListIdentityProviderConfigs.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListInsights.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListNodegroups.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListPodIdentityAssociations.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListTagsForResource.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_ListUpdates.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_RegisterCluster.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_StartInsightsRefresh.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_TagResource.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UntagResource.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateAccessEntry.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateAddon.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateCapability.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateClusterConfig.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateClusterVersion.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateEksAnywhereSubscription.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateNodegroupConfig.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdateNodegroupVersion.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/api_op_UpdatePodIdentityAssociation.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/auth.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/deserializers.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/endpoints.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/generated.json is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/go_module_metadata.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/options.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/serializers.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/types/enums.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/aws-sdk-go-v2/service/eks/types/types.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/crds/karpenter.k8s.aws_ec2nodeclasses.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/crds/karpenter.sh_nodeclaims.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/crds/karpenter.sh_nodeoverlays.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/crds/karpenter.sh_nodepools.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/v1/ec2nodeclass.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/v1/ec2nodeclass_status.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/v1/labels.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/aws/karpenter-provider-aws/pkg/apis/v1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
  • vendor/github.com/awslabs/operatorpkg/status/condition.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/awslabs/operatorpkg/status/condition_set.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/awslabs/operatorpkg/status/unstructured_adapter.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/openshift/hypershift/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
  • vendor/github.com/samber/lo/.golangci.yml is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/Makefile is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/README.md is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/channel.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/concurrency.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/condition.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/errors.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/find.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/intersect.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/map.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/math.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/mutable/slice.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/retry.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/slice.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/string.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/time.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/tuples.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/samber/lo/type_manipulation.go is excluded by !vendor/**, !**/vendor/**
  • vendor/k8s.io/client-go/kubernetes/fake/clientset_generated.go is excluded by !vendor/**, !**/vendor/**
  • vendor/modules.txt is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/crds/karpenter.sh_nodeclaims.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/crds/karpenter.sh_nodeoverlays.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/crds/karpenter.sh_nodepools.yaml is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/v1/duration.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/v1/nodeclaim.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/v1/nodeclaim_status.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/v1/nodepool.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/apis/v1/nodepool_status.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/cloudprovider/types.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/operator/logging/logging.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/scheduling/taints.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/scheduling/volumeusage.go is excluded by !vendor/**, !**/vendor/**
  • vendor/sigs.k8s.io/karpenter/pkg/utils/pretty/pretty.go is excluded by !vendor/**, !**/vendor/**
📒 Files selected for processing (2)
  • api/go.mod
  • go.mod

Comment thread go.mod
Comment on lines +128 to +129
sigs.k8s.io/controller-runtime v0.23.1
sigs.k8s.io/karpenter v1.13.0

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

go list -m -json sigs.k8s.io/controller-runtime k8s.io/api k8s.io/apimachinery k8s.io/client-go
go mod graph | rg 'sigs.k8s.io/controller-runtime|k8s.io/(api|apimachinery|client-go)'

Repository: openshift/hypershift

Length of output: 50376


🌐 Web query:

controller-runtime compatibility table v0.23 v0.22 kubernetes v0.35 v0.34

💡 Result:

Controller-runtime versions are aligned with Kubernetes library (client-go, apimachinery, etc.) versions [1][2]. Each minor version of controller-runtime is tested against a specific minor version of these Kubernetes dependencies [1][2]. The compatibility for the requested versions is as follows [1][2][3]: - Controller-runtime v0.23 is compatible with Kubernetes library dependencies v0.35 [1][2][3]. - Controller-runtime v0.22 is compatible with Kubernetes library dependencies v0.34 [1][2][3]. While controller-runtime may happen to work with other versions of Kubernetes dependencies, such combinations are not supported or tested by the project [1][2]. Users are advised to check the go.mod file of their specific controller-runtime version for the exact dependencies used [1][2].

Citations:


Align the controller-runtime replacement with the Kubernetes minor version

replace makes the effective controller-runtime version v0.22.5, but the module graph is on k8s.io/* v0.35.3. That pairing is outside controller-runtime’s supported matrix (v0.22v0.34, v0.23v0.35). Either remove the downgrade and keep v0.23.1, or align the Kubernetes modules to the supported v0.22 set.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 128 - 129, Update the controller-runtime dependency
configuration so its effective version matches the Kubernetes module minor
version: retain v0.23.1 without a replacement, or consistently downgrade the
k8s.io modules to the supported v0.34 set for v0.22.5. Ensure the module graph
no longer combines controller-runtime v0.22.5 with Kubernetes v0.35.3.

Run `make karpenter-api` to copy the updated CRDs from the vendored
karpenter-provider-aws and apply OpenShift-specific CEL relaxations
via adjust-cel.sh.

New EC2NodeClass fields now available in the CRD:
- connectionTracking: idle connection tracking timeouts on ENIs
- cpuOptions: nested virtualization filtering for instance types
- networkInterfaces: network interface configurations for instances
- placementGroupSelector: placement group selection by name or id

Also syncs updated CRDs for NodeClaim, NodePool, and NodeOverlay.

Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
@jhjaggars
jhjaggars force-pushed the sync-karpenter-ec2nodeclass-crd branch from 8026753 to cdf8713 Compare July 27, 2026 14:53
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 30, 2026
@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@jhjaggars jhjaggars closed this Aug 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/api Indicates the PR includes changes for the API area/karpenter-operator Indicates the PR includes changes related to the Karpenter operator do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants