KubeCon EUBooth 1151, Amsterdam. March 23-26
Terraform

Node Policies

Configure Karpenter node provisioning policies with Terraform.

Node Policies

devzero_node_policy configures Karpenter NodePool and NodeClass resources for node provisioning. devzero_node_policy_target attaches a node policy to one or more clusters.

Node policies manage Karpenter NodePool and NodeClass resources. Ensure Karpenter is installed on your target clusters before attaching node policies.

NodePolicy

Example (AWS)

resource "devzero_node_policy" "standard" {
  name            = "standard-nodes"
  node_pool_name  = "standard"
  node_class_name = "standard"

  instance_categories = ["c", "m", "r"]
  capacity_types      = ["on-demand"]
  architectures       = ["amd64"]

  limits {
    cpu    = "100"
    memory = "400Gi"
  }

  disruption {
    consolidation_policy = "WhenEmptyOrUnderutilized"
    consolidate_after    = "15m"
    expire_after         = "720h"
  }

  aws {
    instance_profile = "KarpenterNodeInstanceProfile"
    ami_family       = "AL2023"

    subnet_selector_terms {
      tags = {
        "karpenter.sh/discovery" = "my-cluster"
      }
    }

    security_group_selector_terms {
      tags = {
        "karpenter.sh/discovery" = "my-cluster"
      }
    }
  }
}

Required Arguments

ParameterTypeRequiredDescription
namestringYesUnique name for the node policy
node_pool_namestringYesName for the Karpenter NodePool
node_class_namestringYesName for the Karpenter NodeClass

Optional Arguments

ParameterTypeDescription
descriptionstringHuman-readable description
weightnumberScheduling weight (default: 10)
instance_categorieslist(string)Instance categories (e.g. ["c", "m", "r"])
instance_familieslist(string)Instance families (e.g. ["c5", "m5"])
instance_generationslist(string)Instance generations
instance_sizeslist(string)Instance sizes (e.g. ["large", "xlarge"])
architectureslist(string)CPU architectures: "amd64", "arm64"
capacity_typeslist(string)Capacity types: "spot", "on-demand"
availability_zoneslist(string)Availability zones to use
labelsmap(string)Labels to apply to provisioned nodes
taintsblockTaints to apply (see below)
limitsblockResource limits for the NodePool (see below)
disruptionblockDisruption/consolidation settings (see below)
awsblockAWS-specific NodeClass configuration (see below)
azureblockAzure-specific NodeClass configuration (see below)

taints Block

ParameterTypeDescription
keystringTaint key
valuestringTaint value
effectstring"NoSchedule", "PreferNoSchedule", or "NoExecute"

limits Block

ParameterTypeDescription
cpustringMaximum total CPU across all nodes (e.g. "100")
memorystringMaximum total memory across all nodes (e.g. "400Gi")

disruption Block

ParameterTypeDescription
consolidation_policystring"WhenEmptyOrUnderutilized" or "WhenEmpty"
consolidate_afterstringTime before consolidating (e.g. "15m")
expire_afterstringMaximum node lifetime (e.g. "720h")

aws Block

ParameterTypeDescription
instance_profilestringIAM instance profile for nodes
ami_familystringAMI family (e.g. "AL2023", "Bottlerocket")
subnet_selector_termsblockSubnet selection by tags or IDs
security_group_selector_termsblockSecurity group selection by tags or IDs
block_device_mappingsblockEBS volume configuration

azure Block

ParameterTypeDescription
vnet_subnet_idstringVNet subnet resource ID
os_disk_size_gbnumberOS disk size in GB
image_familystringVM image family

NodePolicyTarget

devzero_node_policy_target attaches a devzero_node_policy to one or more clusters.

Example

resource "devzero_node_policy_target" "cluster_nodes" {
  name        = "cluster-nodes"
  policy_id   = devzero_node_policy.standard.id
  cluster_ids = [devzero_cluster.production.id]
  enabled     = true
}

Arguments

ParameterTypeRequiredDescription
namestringYesUnique name for the target
policy_idstringYesID of the devzero_node_policy to attach
cluster_idslist(string)YesList of cluster IDs to apply the policy to
descriptionstringNoHuman-readable description
enabledboolNoWhether the target is active (default: true)

On this page