Skip to content

Fixing Karpenter Bottlerocket maxPods with VPC CNI Prefix Delegation

Karpenter

When provisioning worker nodes using Karpenter with AWS Bottlerocket OS and VPC CNI prefix delegation (ENABLE_PREFIX_DELEGATION=true), you may notice that node capacity is restricted to standard limits (e.g. 29 pods on m6i.large) rather than the expected 110 pods.

Root Causes & Fixes

1. Require Nitro-Based EC2 Instances

VPC CNI prefix delegation is exclusively supported on AWS Nitro hypervisors (c5, m5, m6i, c7g, etc.). Older Xen-based instance families do not support prefix delegation.

Enforce Nitro instances in your Karpenter NodePool:

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: primary-nodepool
spec:
  template:
    spec:
      requirements:
        - key: "karpenter.k8s.aws/instance-hypervisor"
          operator: In
          values: ["nitro"]

2. Override Kubelet maxPods in EC2NodeClass

When Karpenter initializes Bottlerocket nodes, Kubelet calculates max pods based on ENI counts unless explicitly overridden in the EC2NodeClass specification.

In Karpenter v1, configure spec.kubelet.maxPods:

apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: bottlerocket-custom
spec:
  amiFamily: Bottlerocket
  role: "KarpenterNodeRole-demo"
  kubelet:
    maxPods: 110
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: "eks-demo"
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: "eks-demo"