Cluster Provider: Lambda exception when validating /tmp/manifest.yaml

[ttirtawi]

Describe the bug

When creating EKS cluster with Fargate and Karpenter, Lambda function for creating cluster resource failed. It failed when trying to run:

Running command: ['kubectl', 'create', '--kubeconfig', '/tmp/kubeconfig', '-f', '/tmp/manifest.yaml', '--save-config']

and got exception:

[ERROR] Exception: b'error: error validating "/tmp/manifest.yaml": error validating data: invalid object to validate; if you choose to ignore these errors, turn validation off with --validate=false\n'

Expected Behavior

No error when creating the EKS cluster with Fargate & Karpenter only without any managed node group.

Current Behavior

Lambda's logs:

INIT_START Runtime Version: python:3.10.v36	Runtime Version ARN: arn:aws:lambda:ap-southeast-3::runtime:bbd47e5ef4020932b9374e2ab9f9ed3bac502f27e17a031c35d9fb8935cf1f8c
START RequestId: 65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e Version: $LATEST
{
    "RequestType": "Create",
    "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
    "ResponseURL": "...",
    "StackId": "arn:aws:cloudformation:ap-southeast-3:452922823873:stack/demoEks2/5b616580-4130-11ef-8292-0a460f05d92e",
    "RequestId": "bafeae57-d38e-47a4-a9df-2379b54180cf",
    "LogicalResourceId": "demoEks2manifestkarpenterk8sec2nodeclassesbeta1crdA8EC70B5",
    "ResourceType": "Custom::AWSCDK-EKS-KubernetesResource",
    "ResourceProperties": {
        "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
        "PruneLabel": "aws.cdk.eks/prune-c820bdce55f0b53802e80c5b8565dbf8f2a893395d",
        "ClusterName": "demoEks2",
        "Manifest": "[[{\"apiVersion\":\"apiextensions.k8s.io/v1\",\"kind\":\"CustomResourceDefinition\",\"metadata\":{\"annotations\":{\"controller-gen.kubebuilder.io/version\":\"v0.15.0\"},\"name\":\"ec2nodeclasses.karpenter.k8s.aws\"},\"spec\":{\"group\":\"karpenter.k8s.aws\",\"names\":{\"categories\":[\"karpenter\"],\"kind\":\"EC2NodeClass\",\"listKind\":\"EC2NodeClassList\",\"plural\":\"ec2nodeclasses\",\"shortNames\":[\"ec2nc\",\"ec2ncs\"],\"singular\":\"ec2nodeclass\"},\"scope\":\"Cluster\",\"versions\":[{\"name\":\"v1beta1\",\"schema\":{\"openAPIV3Schema\":{\"description\":\"EC2NodeClass is the Schema for the EC2NodeClass API\",\"properties\":{\"apiVersion\":{\"description\":\"APIVersion defines the versioned schema of this representation of an object.\\nServers should convert recognized schemas to the latest internal value, and\\nmay reject unrecognized values.\\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\",\"type\":\"string\"},\"kind\":{\"description\":\"Kind is a string value representing the REST resource this object represents.\\nServers may infer this from the endpoint the client submits requests to.\\nCannot be updated.\\nIn CamelCase.\\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\",\"type\":\"string\"},\"metadata\":{\"type\":\"object\"},\"spec\":{\"description\":\"EC2NodeClassSpec is the top level specification for the AWS Karpenter Provider.\\nThis will contain configuration necessary to launch instances in AWS.\",\"properties\":{\"amiFamily\":{\"description\":\"AMIFamily is the AMI family that instances use.\",\"enum\":[\"AL2\",\"AL2023\",\"Bottlerocket\",\"Ubuntu\",\"Custom\",\"Windows2019\",\"Windows2022\"],\"type\":\"string\"},\"amiSelectorTerms\":{\"description\":\"AMISelectorTerms is a list of or ami selector terms. The terms are ORed.\",\"items\":{\"description\":\"AMISelectorTerm defines selection logic for an ami used by Karpenter to launch nodes.\\nIf multiple fields are used for selection, the requirements are ANDed.\",\"properties\":{\"id\":{\"description\":\"ID is the ami id in EC2\",\"pattern\":\"ami-[0-9a-z]+\",\"type\":\"string\"},\"name\":{\"description\":\"Name is the ami name in EC2.\\nThis value is the name field, which is different from the name tag.\",\"type\":\"string\"},\"owner\":{\"description\":\"Owner is the owner for the ami.\\nYou can specify a combination of AWS account IDs, \\\"self\\\", \\\"amazon\\\", and \\\"aws-marketplace\\\"\",\"type\":\"string\"},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags is a map of key/value tags used to select subnets\\nSpecifying '*' for a value selects all values for a given tag key.\",\"maxProperties\":20,\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys or values aren't supported\",\"rule\":\"self.all(k, k != '' && self[k] != '')\"}]}},\"type\":\"object\"},\"maxItems\":30,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"expected at least one, got none, ['tags', 'id', 'name']\",\"rule\":\"self.all(x, has(x.tags) || has(x.id) || has(x.name))\"},{\"message\":\"'id' is mutually exclusive, cannot be set with a combination of other fields in amiSelectorTerms\",\"rule\":\"!self.all(x, has(x.id) && (has(x.tags) || has(x.name) || has(x.owner)))\"}]},\"associatePublicIPAddress\":{\"description\":\"AssociatePublicIPAddress controls if public IP addresses are assigned to instances that are launched with the nodeclass.\",\"type\":\"boolean\"},\"blockDeviceMappings\":{\"description\":\"BlockDeviceMappings to be applied to provisioned nodes.\",\"items\":{\"properties\":{\"deviceName\":{\"description\":\"The device name (for example, /dev/sdh or xvdh).\",\"type\":\"string\"},\"ebs\":{\"description\":\"EBS contains parameters used to automatically set up EBS volumes when an instance is launched.\",\"properties\":{\"deleteOnTermination\":{\"description\":\"DeleteOnTermination indicates whether the EBS volume is deleted on instance termination.\",\"type\":\"boolean\"},\"encrypted\":{\"description\":\"Encrypted indicates whether the EBS volume is encrypted. Encrypted volumes can only\\nbe attached to instances that support Amazon EBS encryption. If you are creating\\na volume from a snapshot, you can't specify an encryption value.\",\"type\":\"boolean\"},\"iops\":{\"description\":\"IOPS is the number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes,\\nthis represents the number of IOPS that are provisioned for the volume. For\\ngp2 volumes, this represents the baseline performance of the volume and the\\nrate at which the volume accumulates I/O credits for bursting.\\n\\n\\nThe following are the supported values for each volume type:\\n\\n\\n   * gp3: 3,000-16,000 IOPS\\n\\n\\n   * io1: 100-64,000 IOPS\\n\\n\\n   * io2: 100-64,000 IOPS\\n\\n\\nFor io1 and io2 volumes, we guarantee 64,000 IOPS only for Instances built\\non the Nitro System (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances).\\nOther instance families guarantee performance up to 32,000 IOPS.\\n\\n\\nThis parameter is supported for io1, io2, and gp3 volumes only. This parameter\\nis not supported for gp2, st1, sc1, or standard volumes.\",\"format\":\"int64\",\"type\":\"integer\"},\"kmsKeyID\":{\"description\":\"KMSKeyID (ARN) of the symmetric Key Management Service (KMS) CMK used for encryption.\",\"type\":\"string\"},\"snapshotID\":{\"description\":\"SnapshotID is the ID of an EBS snapshot\",\"type\":\"string\"},\"throughput\":{\"description\":\"Throughput to provision for a gp3 volume, with a maximum of 1,000 MiB/s.\\nValid Range: Minimum value of 125. Maximum value of 1000.\",\"format\":\"int64\",\"type\":\"integer\"},\"volumeSize\":{\"description\":\"VolumeSize in `Gi`, `G`, `Ti`, or `T`. You must specify either a snapshot ID or\\na volume size. The following are the supported volumes sizes for each volume\\ntype:\\n\\n\\n   * gp2 and gp3: 1-16,384\\n\\n\\n   * io1 and io2: 4-16,384\\n\\n\\n   * st1 and sc1: 125-16,384\\n\\n\\n   * standard: 1-1,024\",\"pattern\":\"^((?:[1-9][0-9]{0,3}|[1-4][0-9]{4}|[5][0-8][0-9]{3}|59000)Gi|(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|[6][0-3][0-9]{3}|64000)G|([1-9]||[1-5][0-7]|58)Ti|([1-9]||[1-5][0-9]|6[0-3]|64)T)$\",\"type\":\"string\"},\"volumeType\":{\"description\":\"VolumeType of the block device.\\nFor more information, see Amazon EBS volume types (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html)\\nin the Amazon Elastic Compute Cloud User Guide.\",\"enum\":[\"standard\",\"io1\",\"io2\",\"gp2\",\"sc1\",\"st1\",\"gp3\"],\"type\":\"string\"}},\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"snapshotID or volumeSize must be defined\",\"rule\":\"has(self.snapshotID) || has(self.volumeSize)\"}]},\"rootVolume\":{\"description\":\"RootVolume is a flag indicating if this device is mounted as kubelet root dir. You can\\nconfigure at most one root volume in BlockDeviceMappings.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"maxItems\":50,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"must have only one blockDeviceMappings with rootVolume\",\"rule\":\"self.filter(x, has(x.rootVolume)?x.rootVolume==true:false).size() <= 1\"}]},\"context\":{\"description\":\"Context is a Reserved field in EC2 APIs\\nhttps://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html\",\"type\":\"string\"},\"detailedMonitoring\":{\"description\":\"DetailedMonitoring controls if detailed monitoring is enabled for instances that are launched\",\"type\":\"boolean\"},\"instanceProfile\":{\"description\":\"InstanceProfile is the AWS entity that instances use.\\nThis field is mutually exclusive from role.\\nThe instance profile should already have a role assigned to it that Karpenter\\n has PassRole permission on for instance launch using this instanceProfile to succeed.\",\"type\":\"string\",\"x-kubernetes-validations\":[{\"message\":\"instanceProfile cannot be empty\",\"rule\":\"self != ''\"}]},\"instanceStorePolicy\":{\"description\":\"InstanceStorePolicy specifies how to handle instance-store disks.\",\"enum\":[\"RAID0\"],\"type\":\"string\"},\"metadataOptions\":{\"default\":{\"httpEndpoint\":\"enabled\",\"httpProtocolIPv6\":\"disabled\",\"httpPutResponseHopLimit\":2,\"httpTokens\":\"required\"},\"description\":\"MetadataOptions for the generated launch template of provisioned nodes.\\n\\n\\nThis specifies the exposure of the Instance Metadata Service to\\nprovisioned EC2 nodes. For more information,\\nsee Instance Metadata and User Data\\n(https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)\\nin the Amazon Elastic Compute Cloud User Guide.\\n\\n\\nRefer to recommended, security best practices\\n(https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node)\\nfor limiting exposure of Instance Metadata and User Data to pods.\\nIf omitted, defaults to httpEndpoint enabled, with httpProtocolIPv6\\ndisabled, with httpPutResponseLimit of 2, and with httpTokens\\nrequired.\",\"properties\":{\"httpEndpoint\":{\"default\":\"enabled\",\"description\":\"HTTPEndpoint enables or disables the HTTP metadata endpoint on provisioned\\nnodes. If metadata options is non-nil, but this parameter is not specified,\\nthe default state is \\\"enabled\\\".\\n\\n\\nIf you specify a value of \\\"disabled\\\", instance metadata will not be accessible\\non the node.\",\"enum\":[\"enabled\",\"disabled\"],\"type\":\"string\"},\"httpProtocolIPv6\":{\"default\":\"disabled\",\"description\":\"HTTPProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata\\nservice on provisioned nodes. If metadata options is non-nil, but this parameter\\nis not specified, the default state is \\\"disabled\\\".\",\"enum\":[\"enabled\",\"disabled\"],\"type\":\"string\"},\"httpPutResponseHopLimit\":{\"default\":2,\"description\":\"HTTPPutResponseHopLimit is the desired HTTP PUT response hop limit for\\ninstance metadata requests. The larger the number, the further instance\\nmetadata requests can travel. Possible values are integers from 1 to 64.\\nIf metadata options is non-nil, but this parameter is not specified, the\\ndefault value is 2.\",\"format\":\"int64\",\"maximum\":64,\"minimum\":1,\"type\":\"integer\"},\"httpTokens\":{\"default\":\"required\",\"description\":\"HTTPTokens determines the state of token usage for instance metadata\\nrequests. If metadata options is non-nil, but this parameter is not\\nspecified, the default state is \\\"required\\\".\\n\\n\\nIf the state is optional, one can choose to retrieve instance metadata with\\nor without a signed token header on the request. If one retrieves the IAM\\nrole credentials without a token, the version 1.0 role credentials are\\nreturned. If one retrieves the IAM role credentials using a valid signed\\ntoken, the version 2.0 role credentials are returned.\\n\\n\\nIf the state is \\\"required\\\", one must send a signed token header with any\\ninstance metadata retrieval requests. In this state, retrieving the IAM\\nrole credentials always returns the version 2.0 credentials; the version\\n1.0 credentials are not available.\",\"enum\":[\"required\",\"optional\"],\"type\":\"string\"}},\"type\":\"object\"},\"role\":{\"description\":\"Role is the AWS identity that nodes use. This field is immutable.\\nThis field is mutually exclusive from instanceProfile.\\nMarking this field as immutable avoids concerns around terminating managed instance profiles from running instances.\\nThis field may be made mutable in the future, assuming the correct garbage collection and drift handling is implemented\\nfor the old instance profiles on an update.\",\"type\":\"string\",\"x-kubernetes-validations\":[{\"message\":\"role cannot be empty\",\"rule\":\"self != ''\"},{\"message\":\"immutable field changed\",\"rule\":\"self == oldSelf\"}]},\"securityGroupSelectorTerms\":{\"description\":\"SecurityGroupSelectorTerms is a list of or security group selector terms. The terms are ORed.\",\"items\":{\"description\":\"SecurityGroupSelectorTerm defines selection logic for a security group used by Karpenter to launch nodes.\\nIf multiple fields are used for selection, the requirements are ANDed.\",\"properties\":{\"id\":{\"description\":\"ID is the security group id in EC2\",\"pattern\":\"sg-[0-9a-z]+\",\"type\":\"string\"},\"name\":{\"description\":\"Name is the security group name in EC2.\\nThis value is the name field, which is different from the name tag.\",\"type\":\"string\"},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags is a map of key/value tags used to select subnets\\nSpecifying '*' for a value selects all values for a given tag key.\",\"maxProperties\":20,\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys or values aren't supported\",\"rule\":\"self.all(k, k != '' && self[k] != '')\"}]}},\"type\":\"object\"},\"maxItems\":30,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"securityGroupSelectorTerms cannot be empty\",\"rule\":\"self.size() != 0\"},{\"message\":\"expected at least one, got none, ['tags', 'id', 'name']\",\"rule\":\"self.all(x, has(x.tags) || has(x.id) || has(x.name))\"},{\"message\":\"'id' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms\",\"rule\":\"!self.all(x, has(x.id) && (has(x.tags) || has(x.name)))\"},{\"message\":\"'name' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms\",\"rule\":\"!self.all(x, has(x.name) && (has(x.tags) || has(x.id)))\"}]},\"subnetSelectorTerms\":{\"description\":\"SubnetSelectorTerms is a list of or subnet selector terms. The terms are ORed.\",\"items\":{\"description\":\"SubnetSelectorTerm defines selection logic for a subnet used by Karpenter to launch nodes.\\nIf multiple fields are used for selection, the requirements are ANDed.\",\"properties\":{\"id\":{\"description\":\"ID is the subnet id in EC2\",\"pattern\":\"subnet-[0-9a-z]+\",\"type\":\"string\"},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags is a map of key/value tags used to select subnets\\nSpecifying '*' for a value selects all values for a given tag key.\",\"maxProperties\":20,\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys or values aren't supported\",\"rule\":\"self.all(k, k != '' && self[k] != '')\"}]}},\"type\":\"object\"},\"maxItems\":30,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"subnetSelectorTerms cannot be empty\",\"rule\":\"self.size() != 0\"},{\"message\":\"expected at least one, got none, ['tags', 'id']\",\"rule\":\"self.all(x, has(x.tags) || has(x.id))\"},{\"message\":\"'id' is mutually exclusive, cannot be set with a combination of other fields in subnetSelectorTerms\",\"rule\":\"!self.all(x, has(x.id) && has(x.tags))\"}]},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags to be applied on ec2 resources like instances and launch templates.\",\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys aren't supported\",\"rule\":\"self.all(k, k != '')\"},{\"message\":\"tag contains a restricted tag matching kubernetes.io/cluster/\",\"rule\":\"self.all(k, !k.startsWith('kubernetes.io/cluster') )\"},{\"message\":\"tag contains a restricted tag matching karpenter.sh/nodepool\",\"rule\":\"self.all(k, k != 'karpenter.sh/nodepool')\"},{\"message\":\"tag contains a restricted tag matching karpenter.sh/managed-by\",\"rule\":\"self.all(k, k !='karpenter.sh/managed-by')\"},{\"message\":\"tag contains a restricted tag matching karpenter.sh/nodeclaim\",\"rule\":\"self.all(k, k !='karpenter.sh/nodeclaim')\"},{\"message\":\"tag contains a restricted tag matching karpenter.k8s.aws/ec2nodeclass\",\"rule\":\"self.all(k, k !='karpenter.k8s.aws/ec2nodeclass')\"}]},\"userData\":{\"description\":\"UserData to be applied to the provisioned nodes.\\nIt must be in the appropriate format based on the AMIFamily in use. Karpenter will merge certain fields into\\nthis UserData to ensure nodes are being provisioned with the correct configuration.\",\"type\":\"string\"}},\"required\":[\"amiFamily\",\"securityGroupSelectorTerms\",\"subnetSelectorTerms\"],\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"amiSelectorTerms is required when amiFamily == 'Custom'\",\"rule\":\"self.amiFamily == 'Custom' ? self.amiSelectorTerms.size() != 0 : true\"},{\"message\":\"must specify exactly one of ['role', 'instanceProfile']\",\"rule\":\"(has(self.role) && !has(self.instanceProfile)) || (!has(self.role) && has(self.instanceProfile))\"},{\"message\":\"changing from 'instanceProfile' to 'role' is not supported. You must delete and recreate this node class if you want to change this.\",\"rule\":\"(has(oldSelf.role) && has(self.role)) || (has(oldSelf.instanceProfile) && has(self.instanceProfile))\"}]},\"status\":{\"description\":\"EC2NodeClassStatus contains the resolved state of the EC2NodeClass\",\"properties\":{\"amis\":{\"description\":\"AMI contains the current AMI values that are available to the\\ncluster under the AMI selectors.\",\"items\":{\"description\":\"AMI contains resolved AMI selector values utilized for node launch\",\"properties\":{\"id\":{\"description\":\"ID of the AMI\",\"type\":\"string\"},\"name\":{\"description\":\"Name of the AMI\",\"type\":\"string\"},\"requirements\":{\"description\":\"Requirements of the AMI to be utilized on an instance type\",\"items\":{\"description\":\"A node selector requirement is a selector that contains values, a key, and an operator\\nthat relates the key and values.\",\"properties\":{\"key\":{\"description\":\"The label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"Represents a key's relationship to a set of values.\\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.\",\"type\":\"string\"},\"values\":{\"description\":\"An array of string values. If the operator is In or NotIn,\\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\\nthe values array must be empty. If the operator is Gt or Lt, the values\\narray must have a single element, which will be interpreted as an integer.\\nThis array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\"}},\"required\":[\"id\",\"requirements\"],\"type\":\"object\"},\"type\":\"array\"},\"conditions\":{\"description\":\"Conditions contains signals for health and readiness\",\"items\":{\"description\":\"Condition aliases the upstream type and adds additional helper methods\",\"properties\":{\"lastTransitionTime\":{\"description\":\"lastTransitionTime is the last time the condition transitioned from one status to another.\\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.\",\"format\":\"date-time\",\"type\":\"string\"},\"message\":{\"description\":\"message is a human readable message indicating details about the transition.\\nThis may be an empty string.\",\"maxLength\":32768,\"type\":\"string\"},\"observedGeneration\":{\"description\":\"observedGeneration represents the .metadata.generation that the condition was set based upon.\\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\\nwith respect to the current state of the instance.\",\"format\":\"int64\",\"minimum\":0,\"type\":\"integer\"},\"reason\":{\"description\":\"reason contains a programmatic identifier indicating the reason for the condition's last transition.\\nProducers of specific condition types may define expected values and meanings for this field,\\nand whether the values are considered a guaranteed API.\\nThe value should be a CamelCase string.\\nThis field may not be empty.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\",\"type\":\"string\"},\"status\":{\"description\":\"status of the condition, one of True, False, Unknown.\",\"enum\":[\"True\",\"False\",\"Unknown\"],\"type\":\"string\"},\"type\":{\"description\":\"type of condition in CamelCase or in foo.example.com/CamelCase.\\n---\\nMany .condition.type values are consistent across resources like Available, but because arbitrary conditions can be\\nuseful (see .node.status.conditions), the ability to deconflict is important.\\nThe regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\",\"maxLength\":316,\"pattern\":\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\",\"type\":\"string\"}},\"required\":[\"lastTransitionTime\",\"message\",\"reason\",\"status\",\"type\"],\"type\":\"object\"},\"type\":\"array\"},\"instanceProfile\":{\"description\":\"InstanceProfile contains the resolved instance profile for the role\",\"type\":\"string\"},\"securityGroups\":{\"description\":\"SecurityGroups contains the current Security Groups values that are available to the\\ncluster under the SecurityGroups selectors.\",\"items\":{\"description\":\"SecurityGroup contains resolved SecurityGroup selector values utilized for node launch\",\"properties\":{\"id\":{\"description\":\"ID of the security group\",\"type\":\"string\"},\"name\":{\"description\":\"Name of the security group\",\"type\":\"string\"}},\"required\":[\"id\"],\"type\":\"object\"},\"type\":\"array\"},\"subnets\":{\"description\":\"Subnets contains the current Subnet values that are available to the\\ncluster under the subnet selectors.\",\"items\":{\"description\":\"Subnet contains resolved Subnet selector values utilized for node launch\",\"properties\":{\"id\":{\"description\":\"ID of the subnet\",\"type\":\"string\"},\"zone\":{\"description\":\"The associated availability zone\",\"type\":\"string\"},\"zoneID\":{\"description\":\"The associated availability zone ID\",\"type\":\"string\"}},\"required\":[\"id\",\"zone\"],\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"served\":true,\"storage\":true,\"subresources\":{\"status\":{}}}]}}]]",
        "RoleArn": "arn:aws:iam::452922823873:role/demoEks2-demoEks2CreationRole9348F220-XYxv8sMIBxFg"
    }
}

[INFO]	2024-07-13T16:13:18.672Z	65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e	
{
    "RequestType": "Create",
    "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
    "ResponseURL": "...",
    "StackId": "arn:aws:cloudformation:ap-southeast-3:452922823873:stack/demoEks2/5b616580-4130-11ef-8292-0a460f05d92e",
    "RequestId": "bafeae57-d38e-47a4-a9df-2379b54180cf",
    "LogicalResourceId": "demoEks2manifestkarpenterk8sec2nodeclassesbeta1crdA8EC70B5",
    "ResourceType": "Custom::AWSCDK-EKS-KubernetesResource",
    "ResourceProperties": {
        "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
        "PruneLabel": "aws.cdk.eks/prune-c820bdce55f0b53802e80c5b8565dbf8f2a893395d",
        "ClusterName": "demoEks2",
        "Manifest": "[[{\"apiVersion\":\"apiextensions.k8s.io/v1\",\"kind\":\"CustomResourceDefinition\",\"metadata\":{\"annotations\":{\"controller-gen.kubebuilder.io/version\":\"v0.15.0\"},\"name\":\"ec2nodeclasses.karpenter.k8s.aws\"},\"spec\":{\"group\":\"karpenter.k8s.aws\",\"names\":{\"categories\":[\"karpenter\"],\"kind\":\"EC2NodeClass\",\"listKind\":\"EC2NodeClassList\",\"plural\":\"ec2nodeclasses\",\"shortNames\":[\"ec2nc\",\"ec2ncs\"],\"singular\":\"ec2nodeclass\"},\"scope\":\"Cluster\",\"versions\":[{\"name\":\"v1beta1\",\"schema\":{\"openAPIV3Schema\":{\"description\":\"EC2NodeClass is the Schema for the EC2NodeClass API\",\"properties\":{\"apiVersion\":{\"description\":\"APIVersion defines the versioned schema of this representation of an object.\\nServers should convert recognized schemas to the latest internal value, and\\nmay reject unrecognized values.\\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\",\"type\":\"string\"},\"kind\":{\"description\":\"Kind is a string value representing the REST resource this object represents.\\nServers may infer this from the endpoint the client submits requests to.\\nCannot be updated.\\nIn CamelCase.\\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\",\"type\":\"string\"},\"metadata\":{\"type\":\"object\"},\"spec\":{\"description\":\"EC2NodeClassSpec is the top level specification for the AWS Karpenter Provider.\\nThis will contain configuration necessary to launch instances in AWS.\",\"properties\":{\"amiFamily\":{\"description\":\"AMIFamily is the AMI family that instances use.\",\"enum\":[\"AL2\",\"AL2023\",\"Bottlerocket\",\"Ubuntu\",\"Custom\",\"Windows2019\",\"Windows2022\"],\"type\":\"string\"},\"amiSelectorTerms\":{\"description\":\"AMISelectorTerms is a list of or ami selector terms. The terms are ORed.\",\"items\":{\"description\":\"AMISelectorTerm defines selection logic for an ami used by Karpenter to launch nodes.\\nIf multiple fields are used for selection, the requirements are ANDed.\",\"properties\":{\"id\":{\"description\":\"ID is the ami id in EC2\",\"pattern\":\"ami-[0-9a-z]+\",\"type\":\"string\"},\"name\":{\"description\":\"Name is the ami name in EC2.\\nThis value is the name field, which is different from the name tag.\",\"type\":\"string\"},\"owner\":{\"description\":\"Owner is the owner for the ami.\\nYou can specify a combination of AWS account IDs, \\\"self\\\", \\\"amazon\\\", and \\\"aws-marketplace\\\"\",\"type\":\"string\"},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags is a map of key/value tags used to select subnets\\nSpecifying '*' for a value selects all values for a given tag key.\",\"maxProperties\":20,\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys or values aren't supported\",\"rule\":\"self.all(k, k != '' && self[k] != '')\"}]}},\"type\":\"object\"},\"maxItems\":30,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"expected at least one, got none, ['tags', 'id', 'name']\",\"rule\":\"self.all(x, has(x.tags) || has(x.id) || has(x.name))\"},{\"message\":\"'id' is mutually exclusive, cannot be set with a combination of other fields in amiSelectorTerms\",\"rule\":\"!self.all(x, has(x.id) && (has(x.tags) || has(x.name) || has(x.owner)))\"}]},\"associatePublicIPAddress\":{\"description\":\"AssociatePublicIPAddress controls if public IP addresses are assigned to instances that are launched with the nodeclass.\",\"type\":\"boolean\"},\"blockDeviceMappings\":{\"description\":\"BlockDeviceMappings to be applied to provisioned nodes.\",\"items\":{\"properties\":{\"deviceName\":{\"description\":\"The device name (for example, /dev/sdh or xvdh).\",\"type\":\"string\"},\"ebs\":{\"description\":\"EBS contains parameters used to automatically set up EBS volumes when an instance is launched.\",\"properties\":{\"deleteOnTermination\":{\"description\":\"DeleteOnTermination indicates whether the EBS volume is deleted on instance termination.\",\"type\":\"boolean\"},\"encrypted\":{\"description\":\"Encrypted indicates whether the EBS volume is encrypted. Encrypted volumes can only\\nbe attached to instances that support Amazon EBS encryption. If you are creating\\na volume from a snapshot, you can't specify an encryption value.\",\"type\":\"boolean\"},\"iops\":{\"description\":\"IOPS is the number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes,\\nthis represents the number of IOPS that are provisioned for the volume. For\\ngp2 volumes, this represents the baseline performance of the volume and the\\nrate at which the volume accumulates I/O credits for bursting.\\n\\n\\nThe following are the supported values for each volume type:\\n\\n\\n   * gp3: 3,000-16,000 IOPS\\n\\n\\n   * io1: 100-64,000 IOPS\\n\\n\\n   * io2: 100-64,000 IOPS\\n\\n\\nFor io1 and io2 volumes, we guarantee 64,000 IOPS only for Instances built\\non the Nitro System (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances).\\nOther instance families guarantee performance up to 32,000 IOPS.\\n\\n\\nThis parameter is supported for io1, io2, and gp3 volumes only. This parameter\\nis not supported for gp2, st1, sc1, or standard volumes.\",\"format\":\"int64\",\"type\":\"integer\"},\"kmsKeyID\":{\"description\":\"KMSKeyID (ARN) of the symmetric Key Management Service (KMS) CMK used for encryption.\",\"type\":\"string\"},\"snapshotID\":{\"description\":\"SnapshotID is the ID of an EBS snapshot\",\"type\":\"string\"},\"throughput\":{\"description\":\"Throughput to provision for a gp3 volume, with a maximum of 1,000 MiB/s.\\nValid Range: Minimum value of 125. Maximum value of 1000.\",\"format\":\"int64\",\"type\":\"integer\"},\"volumeSize\":{\"description\":\"VolumeSize in `Gi`, `G`, `Ti`, or `T`. You must specify either a snapshot ID or\\na volume size. The following are the supported volumes sizes for each volume\\ntype:\\n\\n\\n   * gp2 and gp3: 1-16,384\\n\\n\\n   * io1 and io2: 4-16,384\\n\\n\\n   * st1 and sc1: 125-16,384\\n\\n\\n   * standard: 1-1,024\",\"pattern\":\"^((?:[1-9][0-9]{0,3}|[1-4][0-9]{4}|[5][0-8][0-9]{3}|59000)Gi|(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|[6][0-3][0-9]{3}|64000)G|([1-9]||[1-5][0-7]|58)Ti|([1-9]||[1-5][0-9]|6[0-3]|64)T)$\",\"type\":\"string\"},\"volumeType\":{\"description\":\"VolumeType of the block device.\\nFor more information, see Amazon EBS volume types (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html)\\nin the Amazon Elastic Compute Cloud User Guide.\",\"enum\":[\"standard\",\"io1\",\"io2\",\"gp2\",\"sc1\",\"st1\",\"gp3\"],\"type\":\"string\"}},\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"snapshotID or volumeSize must be defined\",\"rule\":\"has(self.snapshotID) || has(self.volumeSize)\"}]},\"rootVolume\":{\"description\":\"RootVolume is a flag indicating if this device is mounted as kubelet root dir. You can\\nconfigure at most one root volume in BlockDeviceMappings.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"maxItems\":50,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"must have only one blockDeviceMappings with rootVolume\",\"rule\":\"self.filter(x, has(x.rootVolume)?x.rootVolume==true:false).size() <= 1\"}]},\"context\":{\"description\":\"Context is a Reserved field in EC2 APIs\\nhttps://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html\",\"type\":\"string\"},\"detailedMonitoring\":{\"description\":\"DetailedMonitoring controls if detailed monitoring is enabled for instances that are launched\",\"type\":\"boolean\"},\"instanceProfile\":{\"description\":\"InstanceProfile is the AWS entity that instances use.\\nThis field is mutually exclusive from role.\\nThe instance profile should already have a role assigned to it that Karpenter\\n has PassRole permission on for instance launch using this instanceProfile to succeed.\",\"type\":\"string\",\"x-kubernetes-validations\":[{\"message\":\"instanceProfile cannot be empty\",\"rule\":\"self != ''\"}]},\"instanceStorePolicy\":{\"description\":\"InstanceStorePolicy specifies how to handle instance-store disks.\",\"enum\":[\"RAID0\"],\"type\":\"string\"},\"metadataOptions\":{\"default\":{\"httpEndpoint\":\"enabled\",\"httpProtocolIPv6\":\"disabled\",\"httpPutResponseHopLimit\":2,\"httpTokens\":\"required\"},\"description\":\"MetadataOptions for the generated launch template of provisioned nodes.\\n\\n\\nThis specifies the exposure of the Instance Metadata Service to\\nprovisioned EC2 nodes. For more information,\\nsee Instance Metadata and User Data\\n(https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)\\nin the Amazon Elastic Compute Cloud User Guide.\\n\\n\\nRefer to recommended, security best practices\\n(https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node)\\nfor limiting exposure of Instance Metadata and User Data to pods.\\nIf omitted, defaults to httpEndpoint enabled, with httpProtocolIPv6\\ndisabled, with httpPutResponseLimit of 2, and with httpTokens\\nrequired.\",\"properties\":{\"httpEndpoint\":{\"default\":\"enabled\",\"description\":\"HTTPEndpoint enables or disables the HTTP metadata endpoint on provisioned\\nnodes. If metadata options is non-nil, but this parameter is not specified,\\nthe default state is \\\"enabled\\\".\\n\\n\\nIf you specify a value of \\\"disabled\\\", instance metadata will not be accessible\\non the node.\",\"enum\":[\"enabled\",\"disabled\"],\"type\":\"string\"},\"httpProtocolIPv6\":{\"default\":\"disabled\",\"description\":\"HTTPProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata\\nservice on provisioned nodes. If metadata options is non-nil, but this parameter\\nis not specified, the default state is \\\"disabled\\\".\",\"enum\":[\"enabled\",\"disabled\"],\"type\":\"string\"},\"httpPutResponseHopLimit\":{\"default\":2,\"description\":\"HTTPPutResponseHopLimit is the desired HTTP PUT response hop limit for\\ninstance metadata requests. The larger the number, the further instance\\nmetadata requests can travel. Possible values are integers from 1 to 64.\\nIf metadata options is non-nil, but this parameter is not specified, the\\ndefault value is 2.\",\"format\":\"int64\",\"maximum\":64,\"minimum\":1,\"type\":\"integer\"},\"httpTokens\":{\"default\":\"required\",\"description\":\"HTTPTokens determines the state of token usage for instance metadata\\nrequests. If metadata options is non-nil, but this parameter is not\\nspecified, the default state is \\\"required\\\".\\n\\n\\nIf the state is optional, one can choose to retrieve instance metadata with\\nor without a signed token header on the request. If one retrieves the IAM\\nrole credentials without a token, the version 1.0 role credentials are\\nreturned. If one retrieves the IAM role credentials using a valid signed\\ntoken, the version 2.0 role credentials are returned.\\n\\n\\nIf the state is \\\"required\\\", one must send a signed token header with any\\ninstance metadata retrieval requests. In this state, retrieving the IAM\\nrole credentials always returns the version 2.0 credentials; the version\\n1.0 credentials are not available.\",\"enum\":[\"required\",\"optional\"],\"type\":\"string\"}},\"type\":\"object\"},\"role\":{\"description\":\"Role is the AWS identity that nodes use. This field is immutable.\\nThis field is mutually exclusive from instanceProfile.\\nMarking this field as immutable avoids concerns around terminating managed instance profiles from running instances.\\nThis field may be made mutable in the future, assuming the correct garbage collection and drift handling is implemented\\nfor the old instance profiles on an update.\",\"type\":\"string\",\"x-kubernetes-validations\":[{\"message\":\"role cannot be empty\",\"rule\":\"self != ''\"},{\"message\":\"immutable field changed\",\"rule\":\"self == oldSelf\"}]},\"securityGroupSelectorTerms\":{\"description\":\"SecurityGroupSelectorTerms is a list of or security group selector terms. The terms are ORed.\",\"items\":{\"description\":\"SecurityGroupSelectorTerm defines selection logic for a security group used by Karpenter to launch nodes.\\nIf multiple fields are used for selection, the requirements are ANDed.\",\"properties\":{\"id\":{\"description\":\"ID is the security group id in EC2\",\"pattern\":\"sg-[0-9a-z]+\",\"type\":\"string\"},\"name\":{\"description\":\"Name is the security group name in EC2.\\nThis value is the name field, which is different from the name tag.\",\"type\":\"string\"},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags is a map of key/value tags used to select subnets\\nSpecifying '*' for a value selects all values for a given tag key.\",\"maxProperties\":20,\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys or values aren't supported\",\"rule\":\"self.all(k, k != '' && self[k] != '')\"}]}},\"type\":\"object\"},\"maxItems\":30,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"securityGroupSelectorTerms cannot be empty\",\"rule\":\"self.size() != 0\"},{\"message\":\"expected at least one, got none, ['tags', 'id', 'name']\",\"rule\":\"self.all(x, has(x.tags) || has(x.id) || has(x.name))\"},{\"message\":\"'id' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms\",\"rule\":\"!self.all(x, has(x.id) && (has(x.tags) || has(x.name)))\"},{\"message\":\"'name' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms\",\"rule\":\"!self.all(x, has(x.name) && (has(x.tags) || has(x.id)))\"}]},\"subnetSelectorTerms\":{\"description\":\"SubnetSelectorTerms is a list of or subnet selector terms. The terms are ORed.\",\"items\":{\"description\":\"SubnetSelectorTerm defines selection logic for a subnet used by Karpenter to launch nodes.\\nIf multiple fields are used for selection, the requirements are ANDed.\",\"properties\":{\"id\":{\"description\":\"ID is the subnet id in EC2\",\"pattern\":\"subnet-[0-9a-z]+\",\"type\":\"string\"},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags is a map of key/value tags used to select subnets\\nSpecifying '*' for a value selects all values for a given tag key.\",\"maxProperties\":20,\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys or values aren't supported\",\"rule\":\"self.all(k, k != '' && self[k] != '')\"}]}},\"type\":\"object\"},\"maxItems\":30,\"type\":\"array\",\"x-kubernetes-validations\":[{\"message\":\"subnetSelectorTerms cannot be empty\",\"rule\":\"self.size() != 0\"},{\"message\":\"expected at least one, got none, ['tags', 'id']\",\"rule\":\"self.all(x, has(x.tags) || has(x.id))\"},{\"message\":\"'id' is mutually exclusive, cannot be set with a combination of other fields in subnetSelectorTerms\",\"rule\":\"!self.all(x, has(x.id) && has(x.tags))\"}]},\"tags\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Tags to be applied on ec2 resources like instances and launch templates.\",\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"empty tag keys aren't supported\",\"rule\":\"self.all(k, k != '')\"},{\"message\":\"tag contains a restricted tag matching kubernetes.io/cluster/\",\"rule\":\"self.all(k, !k.startsWith('kubernetes.io/cluster') )\"},{\"message\":\"tag contains a restricted tag matching karpenter.sh/nodepool\",\"rule\":\"self.all(k, k != 'karpenter.sh/nodepool')\"},{\"message\":\"tag contains a restricted tag matching karpenter.sh/managed-by\",\"rule\":\"self.all(k, k !='karpenter.sh/managed-by')\"},{\"message\":\"tag contains a restricted tag matching karpenter.sh/nodeclaim\",\"rule\":\"self.all(k, k !='karpenter.sh/nodeclaim')\"},{\"message\":\"tag contains a restricted tag matching karpenter.k8s.aws/ec2nodeclass\",\"rule\":\"self.all(k, k !='karpenter.k8s.aws/ec2nodeclass')\"}]},\"userData\":{\"description\":\"UserData to be applied to the provisioned nodes.\\nIt must be in the appropriate format based on the AMIFamily in use. Karpenter will merge certain fields into\\nthis UserData to ensure nodes are being provisioned with the correct configuration.\",\"type\":\"string\"}},\"required\":[\"amiFamily\",\"securityGroupSelectorTerms\",\"subnetSelectorTerms\"],\"type\":\"object\",\"x-kubernetes-validations\":[{\"message\":\"amiSelectorTerms is required when amiFamily == 'Custom'\",\"rule\":\"self.amiFamily == 'Custom' ? self.amiSelectorTerms.size() != 0 : true\"},{\"message\":\"must specify exactly one of ['role', 'instanceProfile']\",\"rule\":\"(has(self.role) && !has(self.instanceProfile)) || (!has(self.role) && has(self.instanceProfile))\"},{\"message\":\"changing from 'instanceProfile' to 'role' is not supported. You must delete and recreate this node class if you want to change this.\",\"rule\":\"(has(oldSelf.role) && has(self.role)) || (has(oldSelf.instanceProfile) && has(self.instanceProfile))\"}]},\"status\":{\"description\":\"EC2NodeClassStatus contains the resolved state of the EC2NodeClass\",\"properties\":{\"amis\":{\"description\":\"AMI contains the current AMI values that are available to the\\ncluster under the AMI selectors.\",\"items\":{\"description\":\"AMI contains resolved AMI selector values utilized for node launch\",\"properties\":{\"id\":{\"description\":\"ID of the AMI\",\"type\":\"string\"},\"name\":{\"description\":\"Name of the AMI\",\"type\":\"string\"},\"requirements\":{\"description\":\"Requirements of the AMI to be utilized on an instance type\",\"items\":{\"description\":\"A node selector requirement is a selector that contains values, a key, and an operator\\nthat relates the key and values.\",\"properties\":{\"key\":{\"description\":\"The label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"Represents a key's relationship to a set of values.\\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.\",\"type\":\"string\"},\"values\":{\"description\":\"An array of string values. If the operator is In or NotIn,\\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\\nthe values array must be empty. If the operator is Gt or Lt, the values\\narray must have a single element, which will be interpreted as an integer.\\nThis array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\"}},\"required\":[\"id\",\"requirements\"],\"type\":\"object\"},\"type\":\"array\"},\"conditions\":{\"description\":\"Conditions contains signals for health and readiness\",\"items\":{\"description\":\"Condition aliases the upstream type and adds additional helper methods\",\"properties\":{\"lastTransitionTime\":{\"description\":\"lastTransitionTime is the last time the condition transitioned from one status to another.\\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.\",\"format\":\"date-time\",\"type\":\"string\"},\"message\":{\"description\":\"message is a human readable message indicating details about the transition.\\nThis may be an empty string.\",\"maxLength\":32768,\"type\":\"string\"},\"observedGeneration\":{\"description\":\"observedGeneration represents the .metadata.generation that the condition was set based upon.\\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\\nwith respect to the current state of the instance.\",\"format\":\"int64\",\"minimum\":0,\"type\":\"integer\"},\"reason\":{\"description\":\"reason contains a programmatic identifier indicating the reason for the condition's last transition.\\nProducers of specific condition types may define expected values and meanings for this field,\\nand whether the values are considered a guaranteed API.\\nThe value should be a CamelCase string.\\nThis field may not be empty.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$\",\"type\":\"string\"},\"status\":{\"description\":\"status of the condition, one of True, False, Unknown.\",\"enum\":[\"True\",\"False\",\"Unknown\"],\"type\":\"string\"},\"type\":{\"description\":\"type of condition in CamelCase or in foo.example.com/CamelCase.\\n---\\nMany .condition.type values are consistent across resources like Available, but because arbitrary conditions can be\\nuseful (see .node.status.conditions), the ability to deconflict is important.\\nThe regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)\",\"maxLength\":316,\"pattern\":\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$\",\"type\":\"string\"}},\"required\":[\"lastTransitionTime\",\"message\",\"reason\",\"status\",\"type\"],\"type\":\"object\"},\"type\":\"array\"},\"instanceProfile\":{\"description\":\"InstanceProfile contains the resolved instance profile for the role\",\"type\":\"string\"},\"securityGroups\":{\"description\":\"SecurityGroups contains the current Security Groups values that are available to the\\ncluster under the SecurityGroups selectors.\",\"items\":{\"description\":\"SecurityGroup contains resolved SecurityGroup selector values utilized for node launch\",\"properties\":{\"id\":{\"description\":\"ID of the security group\",\"type\":\"string\"},\"name\":{\"description\":\"Name of the security group\",\"type\":\"string\"}},\"required\":[\"id\"],\"type\":\"object\"},\"type\":\"array\"},\"subnets\":{\"description\":\"Subnets contains the current Subnet values that are available to the\\ncluster under the subnet selectors.\",\"items\":{\"description\":\"Subnet contains resolved Subnet selector values utilized for node launch\",\"properties\":{\"id\":{\"description\":\"ID of the subnet\",\"type\":\"string\"},\"zone\":{\"description\":\"The associated availability zone\",\"type\":\"string\"},\"zoneID\":{\"description\":\"The associated availability zone ID\",\"type\":\"string\"}},\"required\":[\"id\",\"zone\"],\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"served\":true,\"storage\":true,\"subresources\":{\"status\":{}}}]}}]]",
        "RoleArn": "arn:aws:iam::452922823873:role/demoEks2-demoEks2CreationRole9348F220-XYxv8sMIBxFg"
    }
}

[INFO]	2024-07-13T16:13:18.672Z	65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e	Running command: ['aws', 'eks', 'update-kubeconfig', '--role-arn', 'arn:aws:iam::452922823873:role/demoEks2-demoEks2CreationRole9348F220-XYxv8sMIBxFg', '--name', 'demoEks2', '--kubeconfig', '/tmp/kubeconfig']
Added new context arn:aws:eks:ap-southeast-3:452922823873:cluster/demoEks2 to /tmp/kubeconfig
[INFO]	2024-07-13T16:13:21.182Z	65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e	manifest written to: /tmp/manifest.yaml
[INFO]	2024-07-13T16:13:21.182Z	65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e	Running command: ['kubectl', 'create', '--kubeconfig', '/tmp/kubeconfig', '-f', '/tmp/manifest.yaml', '--save-config']
LAMBDA_WARNING: Unhandled exception. The most likely cause is an issue in the function code. However, in rare cases, a Lambda runtime update can cause unexpected function behavior. For functions using managed runtimes, runtime updates can be triggered by a function change, or can be applied automatically. To determine if the runtime has been updated, check the runtime version in the INIT_START log entry. If this error correlates with a change in the runtime version, you may be able to mitigate this error by temporarily rolling back to the previous runtime version. For more information, see https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html
[ERROR] Exception: b'error: error validating "/tmp/manifest.yaml": error validating data: invalid object to validate; if you choose to ignore these errors, turn validation off with --validate=false\n'
Traceback (most recent call last):
  File "/var/task/index.py", line 14, in handler
    return apply_handler(event, context)
  File "/var/task/apply/__init__.py", line 64, in apply_handler
    kubectl('create', manifest_file, *kubectl_opts)
  File "/var/task/apply/__init__.py", line 91, in kubectl
    raise Exception(output)
END RequestId: 65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e
REPORT RequestId: 65ea0ab8-cc2e-4b3e-94fe-4b6e3fd21f1e	Duration: 3168.94 ms	Billed Duration: 3169 ms	Memory Size: 1024 MB	Max Memory Used: 120 MB	Init Duration: 214.34 ms	
START RequestId: 23bad250-ef26-4d50-a439-814ee483fcdf Version: $LATEST
{
    "RequestType": "Delete",
    "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
    "ResponseURL": "...",
    "StackId": "arn:aws:cloudformation:ap-southeast-3:452922823873:stack/demoEks2/5b616580-4130-11ef-8292-0a460f05d92e",
    "RequestId": "c2d9544e-1d6d-4a2a-b215-bb43360640f7",
    "LogicalResourceId": "demoEks2chartmetricsserver97AD4A1F",
    "PhysicalResourceId": "demoEks2-demoEks2chartmetricsserver97AD4A1F-11AE5BKFF8PM9",
    "ResourceType": "Custom::AWSCDK-EKS-HelmChart",
    "ResourceProperties": {
        "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
        "Repository": "https://kubernetes-sigs.github.io/metrics-server",
        "Version": "3.12.1",
        "Values": "{\"chart\":\"metrics-server\",\"repository\":\"https://kubernetes-sigs.github.io/metrics-server\",\"version\":\"3.12.1\",\"release\":\"blueprints-addon-metrics-server\",\"name\":\"metrics-server\",\"namespace\":\"kube-system\",\"createNamespace\":false}",
        "ClusterName": "demoEks2",
        "RoleArn": "arn:aws:iam::452922823873:role/demoEks2-demoEks2CreationRole9348F220-XYxv8sMIBxFg",
        "Release": "blueprints-addon-metrics-server",
        "Chart": "metrics-server",
        "Namespace": "kube-system",
        "CreateNamespace": "true"
    }
}

[INFO]	2024-07-13T16:13:25.665Z	23bad250-ef26-4d50-a439-814ee483fcdf	
{
    "RequestType": "Delete",
    "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
    "ResponseURL": "...",
    "StackId": "arn:aws:cloudformation:ap-southeast-3:452922823873:stack/demoEks2/5b616580-4130-11ef-8292-0a460f05d92e",
    "RequestId": "c2d9544e-1d6d-4a2a-b215-bb43360640f7",
    "LogicalResourceId": "demoEks2chartmetricsserver97AD4A1F",
    "PhysicalResourceId": "demoEks2-demoEks2chartmetricsserver97AD4A1F-11AE5BKFF8PM9",
    "ResourceType": "Custom::AWSCDK-EKS-HelmChart",
    "ResourceProperties": {
        "ServiceToken": "arn:aws:lambda:ap-southeast-3:452922823873:function:demoEks2-awscdkawseksKube-ProviderframeworkonEvent-HB3OmWpPiO4l",
        "Repository": "https://kubernetes-sigs.github.io/metrics-server",
        "Version": "3.12.1",
        "Values": "{\"chart\":\"metrics-server\",\"repository\":\"https://kubernetes-sigs.github.io/metrics-server\",\"version\":\"3.12.1\",\"release\":\"blueprints-addon-metrics-server\",\"name\":\"metrics-server\",\"namespace\":\"kube-system\",\"createNamespace\":false}",
        "ClusterName": "demoEks2",
        "RoleArn": "arn:aws:iam::452922823873:role/demoEks2-demoEks2CreationRole9348F220-XYxv8sMIBxFg",
        "Release": "blueprints-addon-metrics-server",
        "Chart": "metrics-server",
        "Namespace": "kube-system",
        "CreateNamespace": "true"
    }
}

Updated context arn:aws:eks:ap-southeast-3:452922823873:cluster/demoEks2 in /tmp/kubeconfig
[INFO]	2024-07-13T16:13:30.948Z	23bad250-ef26-4d50-a439-814ee483fcdf	b'release "blueprints-addon-metrics-server" uninstalled\n'
END RequestId: 23bad250-ef26-4d50-a439-814ee483fcdf
REPORT RequestId: 23bad250-ef26-4d50-a439-814ee483fcdf	Duration: 5284.22 ms	Billed Duration: 5285 ms	Memory Size: 1024 MB	Max Memory Used: 201 MB	

Reproduction Steps

I use the following CDK stack to create the cluster:

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import * as blueprints from '@aws-quickstart/eks-blueprints';
import { CdkEKSDemoClusterVpcStack } from '../lib/cdk-eks-blueprint-stack';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as eks from 'aws-cdk-lib/aws-eks';
import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';

const app = new cdk.App();

const vpcStack = new CdkEKSDemoClusterVpcStack(app, 'eksVpc', {
  env: {
      account: "452922823873",
      region: "ap-southeast-3"
  }
});

const fargateProfiles = {
  karpenter: {
    selectors: [
      {
        namespace: 'karpenter'
      }
    ]
  }
}
const clusterProviderFargate = new blueprints.FargateClusterProvider({
  version: eks.KubernetesVersion.V1_29,
  fargateProfiles,
});

const addOns: Array<blueprints.ClusterAddOn> = [
  new blueprints.addons.MetricsServerAddOn(),
  new blueprints.addons.AwsLoadBalancerControllerAddOn(),
  new blueprints.addons.VpcCniAddOn(),
  new blueprints.addons.EbsCsiDriverAddOn({
    storageClass: 'gp3',    
    version: 'auto',
  }),
  new blueprints.addons.CoreDnsAddOn(),
  new blueprints.addons.KubeProxyAddOn(),
  new blueprints.addons.KarpenterAddOn({
    installCRDs: true,
    version: '0.37.0',
    interruptionHandling: true,
    nodePoolSpec: {
      requirements: [
          { key: 'topology.kubernetes.io/zone', operator: 'In', values: ['ap-southeast-3a', 'ap-southeast-3b', 'ap-southeast-3c']}
      ],
      weight: 90
    },
    ec2NodeClassSpec: {
      amiFamily: 'AL2',
      blockDeviceMappings: [{
        deviceName: "/dev/xvda",
        ebs: {
          volumeSize: '100Gi',
          volumeType: autoscaling.EbsDeviceVolumeType.GP3,
          deleteOnTermination: true,
          throughput: 250,
          iops: 3000,
        },
      }],
      subnetSelectorTerms: [
        {
         tags: {
            "aws-cdk:subnet-type": "Private",
            "aws:cloudformation:stack-name": "eksVpc"
         }
        }
      ],
			securityGroupSelectorTerms: [
			{
				tags: {
					"aws:eks:cluster-name": "demoEks2"
				}
			}
			]
    }
  })
];


const cluster = blueprints.EksBlueprint.builder()
.account("452922823873")
.region("ap-southeast-3")
.version("auto")
.resourceProvider(blueprints.GlobalResources.Vpc, new blueprints.DirectVpcProvider(vpcStack.vpc))
.clusterProvider(clusterProviderFargate)
.addOns(...addOns)
.build(app, "demoEks2")

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.147.3 (build 32f0fdb)

EKS Blueprints Version

1.15.1

Node.js Version

v20.15.1

Environment details (OS name and version, etc.)

Ubuntu 22.04.4 LTS

Other information

No response