✨ Add ExistingLaunchTemplate (BYO) support for EKS managed node groups by AmitSahastra · Pull Request #5906 · kubernetes-sigs/cluster-api-provider-aws

AmitSahastra · 2026-03-16T07:16:22Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adds BYO (bring-your-own) launch template support for EKS managed node groups by introducing an id field on AWSLaunchTemplate (in both v1beta1 and v1beta2). When spec.awsLaunchTemplate.id is set, CAPA references the pre-existing AWS launch template directly instead of creating or managing one.

This enables use cases where organizations manage launch templates externally (Terraform, CloudFormation, the AWS console, etc.) and want CAPA to adopt them as-is for EKS managed node groups.

Highlights:

API: new id field and immutable name field on AWSLaunchTemplate (v1beta1 + v1beta2), with CEL self == oldSelf immutability markers and regenerated CRDs/conversions.
Controller: when id is set, the reconciler skips LT create/update/delete and uses the referenced template directly; status (launchTemplateID / launchTemplateVersion) is populated from the spec. CAPA-managed (no-id) behaviour is unchanged.
Webhook: BYO-specific gates — versionNumber required; LT-level fields that only make sense for CAPA-managed LTs (ami, instanceType, rootVolume, nonRootVolumes, sshKeyName, image-lookup fields, additionalSecurityGroups) are forbidden; id/name immutability. Plus cross-cutting gates aligned with the AWS CreateNodegroup contract: spec.instanceType and spec.amiType are allowed alongside a BYO LT, while spec.diskSize and spec.remoteAccess are rejected whenever any LT is specified.
Nodegroup service: BYO-LT-aware CreateNodegroup path — InstanceTypes and AmiType flow through for BYO LTs, RemoteAccess and DiskSize are omitted when a LT is in use; symbolic LT versions ($Latest, $Default) are handled to avoid endless reconcile loops; guards added for nil Version/ReleaseVersion on failed node groups.

Which issue(s) this PR fixes (optional, in fixes # (, fixes #, ...) format, will close the issue(s) when PR gets merged):
Fixes #5896

Special notes for your reviewer:

VersionNumber is intentionally mutable on AWSLaunchTemplate so users can roll out a new LT version to the node group; id and name are immutable (enforced via CEL and the webhook).
For BYO LTs, CAPA cannot introspect the referenced template, so conflicts between node-group-level fields (e.g. amiType, amiVersion) and a LT that already pins a custom AMI are surfaced by the EKS API at create time rather than at admission.
How to exercise locally:
1. Create an EC2 launch template in AWS.
2. Reference it on an AWSManagedMachinePool:
```
spec:
  awsLaunchTemplate:
    id: lt-xxxxxxxxxxxx
    versionNumber: 1
```
3. The node group is created using the referenced launch template; CAPA does not delete the LT on pool deletion.

AI Usage:

AI assistance (Warp Agent Mode) was used for drafting webhook validation and writing unit tests. All generated code was reviewed, tested, and signed off by the author.

Checklist:

Release note:

Add BYO launch template support for EKS managed node groups via the new `spec.awsLaunchTemplate.id` field on `AWSManagedMachinePool`. When set, CAPA uses the referenced pre-existing AWS launch template directly and does not create, update, or delete it.

k8s-ci-robot · 2026-03-16T07:16:31Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign damdo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-03-16T07:16:34Z

Hi @AmitSahastra. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

AmitSahastra · 2026-04-10T03:18:56Z

Hi @fiunchinho @serngawy the bot suggested I consider joining the kubernetes-sigs org given my contributions. Would either of you be willing to sponsor me for membership? I'm happy to open the formal request at https://github.com/kubernetes/org/issues/new?template=membership.md once I have two sponsors confirmed. Thanks!

serngawy · 2026-04-17T16:24:34Z

/ok-to-test

k8s-ci-robot · 2026-05-11T04:48:32Z

@AmitSahastra: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-e2e-eks	`bd527ac`	link	false	`/test pull-cluster-api-provider-aws-e2e-eks`
pull-cluster-api-provider-aws-e2e	`bd527ac`	link	false	`/test pull-cluster-api-provider-aws-e2e`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-ci-robot · 2026-06-20T06:15:47Z

Adding label do-not-merge/contains-merge-commits because PR contains merge commits, which are not allowed in this repository.
Use git rebase to reapply your commits on top of the target branch. Detailed instructions for doing so can be found here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kubernetes-prow · 2026-06-24T16:43:10Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign damdo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Allow users to reference a pre-existing (BYO) AWS EC2 launch template by ID in AWSManagedMachinePoolSpec.AWSLaunchTemplate, instead of having CAPA create and manage one. When AWSLaunchTemplate.ID is set: - CAPA uses the referenced template directly and will not create, update, or delete it - versionNumber is required; CAPA-managed fields (ami, instanceType, sshKeyName, rootVolume, etc.) are forbidden - ID and Name are immutable after creation; versionNumber is mutable to support rolling out new template versions without replacing the nodegroup Key changes: - New ID field on exp/api/v1beta2.AWSLaunchTemplate with CEL immutability rule; v1beta1 is NOT modified (field is v1beta2-only per deprecation policy); ID survives v1beta2→v1beta1→v1beta2 round-trips via the CAPI MarshalData/UnmarshalData annotation mechanism, restored in ConvertTo for both AWSManagedMachinePool and AWSMachinePool - Generated files (CRDs, deepcopy, conversion) produced by make generate; v1beta1 CRD schema has no id field or XValidation rules - IsBYOLaunchTemplate() scope helper gates controller and nodegroup service to skip LT create/delete lifecycle for BYO templates - Webhook validates BYO-specific invariants and immutability - launchTemplateNeedsUpdate() helper covers ID changes and concrete version changes while skipping symbolic aliases ($Latest, $Default) to prevent endless reconcile loops - Guard against nil Version/ReleaseVersion on CREATE_FAILED/DELETE_FAILED nodegroups - LaunchTemplateNeedsUpdate returns a reason enum for improved log output - e2e test (BYOMachinePoolSpec): creates a real EC2 launch template, creates the nodegroup, and verifies the nodegroup uses the BYO template ID Signed-off-by: Amit Sahastrabuddhe <amit.sahastra@gmail.com>

…node groups

…groups

- remove immutability markers from AWSLaunchTemplate.Name (kept on the new id field) since the shared type is also used by AWSMachinePool; regenerate CRDs - split BYO ami validation into separate ami.id and ami.eksLookupType errors - extract BYO-specific launch template validation into validateBYOLaunchTemplate - replace reflect.DeepEqual immutability helper with cmp.Equal-based checks inline - add IsCAPAManagedLaunchTemplate scope helper and use it in the controller - use ptr.Deref in IsBYOLaunchTemplate and reuse the scope helper in the nodegroup service - drop redundant nil guards when restoring the v1beta2-only id in conversion Signed-off-by: Amit Sahastrabuddhe <amit.sahastra@gmail.com>

richardcase · 2026-07-21T14:25:40Z

/test pull-cluster-api-provider-aws-test

richardcase · 2026-07-21T14:26:18Z

/test ?

richardcase · 2026-07-21T14:26:45Z

/test pull-cluster-api-provider-aws-e2e-eks
/test pull-cluster-api-provider-aws-e2e

Copilot

Pull request overview

This PR adds BYO (bring-your-own) EC2 launch template support for EKS managed node groups by introducing an awsLaunchTemplate.id field and updating reconciliation, validation, and tests so CAPA can reference an existing launch template without managing its lifecycle.

Changes:

Add BYO launch template semantics to AWSLaunchTemplate and update controller/service logic to skip LT lifecycle management when id is set.
Update webhook validation/immutability checks and add focused unit tests for launch template version drift handling.
Add new E2E flavor + helpers to exercise managed node groups using a pre-created EC2 launch template.

Reviewed changes

Copilot reviewed 17 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/e2e/suites/managed/machine_pool.go	Adds a BYO-machine-pool spec helper and wires env var substitution for the new flavor.
test/e2e/suites/managed/helpers.go	Adds EC2 LT create/delete helpers and a verifier that the nodegroup uses the expected LT ID.
test/e2e/suites/managed/eks_test.go	Runs a new E2E scenario creating a managed node pool using a BYO launch template.
test/e2e/shared/defaults.go	Introduces env var keys for BYO LT ID/version template rendering.
test/e2e/data/eks/cluster-template-eks-managed-machinepool-with-byo-launch-template-only.yaml	New E2E flavor manifest for BYO LT managed machine pool.
test/e2e/data/e2e_eks_conf.yaml	Registers the new E2E flavor template for artifact publishing/consumption.
pkg/cloud/services/eks/nodegroup.go	Updates CreateNodegroup/UpdateNodegroupVersion behavior for BYO LT and symbolic versions; adds failed-nodegroup guards.
pkg/cloud/services/eks/nodegroup_test.go	Unit tests for symbolic LT version detection and LT drift logic.
pkg/cloud/scope/managednodegroup.go	Adds helpers to distinguish BYO vs CAPA-managed LTs and adjusts LT naming behavior.
exp/webhooks/awsmanagedmachinepool_webhook.go	Adds BYO-specific validation and immutability rules; aligns with EKS CreateNodegroup contract.
exp/webhooks/awsmanagedmachinepool_webhook_test.go	Adds webhook test coverage for BYO validations and immutability constraints.
exp/controllers/awsmanagedmachinepool_controller.go	Skips LT create/update/delete for BYO and sets LT status directly from spec.
exp/api/v1beta2/zz_generated.deepcopy.go	Regenerates deepcopy for the new `AWSLaunchTemplate.ID` field.
exp/api/v1beta2/types.go	Adds `AWSLaunchTemplate.ID` field (BYO LT reference) to v1beta2 API.
exp/api/v1beta2/awsmanagedmachinepool_types.go	Documents BYO LT behavior on `AWSManagedMachinePoolSpec.AWSLaunchTemplate`.
exp/api/v1beta1/zz_generated.conversion.go	Regenerated conversion code reflecting v1beta2-only fields.
exp/api/v1beta1/conversion.go	Preserves/drops v1beta2-only LT fields across hub/spoke conversions via annotations.
config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml	Regenerates CRD schema to include `awsLaunchTemplate.id` with immutability validation.
config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachinepools.yaml	Regenerates CRD schema to include `awsLaunchTemplate.id` with immutability validation.

Files not reviewed (2)

exp/api/v1beta1/zz_generated.conversion.go: Generated file
exp/api/v1beta2/zz_generated.deepcopy.go: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…RD level Set amiType (AL2023_x86_64_STANDARD) and instanceType on the BYO launch template managed machine pool e2e flavor. Without an explicit amiType, EKS defaults to AL2_x86_64, which is rejected for Kubernetes 1.33+, so the nodegroup was never created and the e2e-eks suite timed out waiting for ready nodes. Setting these also exercises the supported path where amiType and instanceType are supplied alongside a BYO launch template. Add a CEL immutability rule for awsLaunchTemplate.name on the AWSManagedMachinePool spec so the immutability contract already enforced by the webhook is visible at the CRD level, consistent with awsLaunchTemplate.id. The rule is scoped to the AWSManagedMachinePool field rather than the shared AWSLaunchTemplate type because AWSMachinePool ignores awsLaunchTemplate.name and does not treat it as immutable. Signed-off-by: Amit Sahastrabuddhe <amit.sahastra@gmail.com>

kubernetes-prow · 2026-07-27T03:55:09Z

@AmitSahastra: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-e2e-eks	`23cfe6a`	link	false	`/test pull-cluster-api-provider-aws-e2e-eks`
pull-cluster-api-provider-aws-e2e	`23cfe6a`	link	false	`/test pull-cluster-api-provider-aws-e2e`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

AmitSahastra · 2026-07-27T04:11:21Z

/retest pull-cluster-api-provider-aws-e2e-blocking

AmitSahastra · 2026-07-27T04:12:04Z

/test pull-cluster-api-provider-aws-e2e-blocking

kubernetes-prow · 2026-08-10T05:46:36Z

Adding label do-not-merge/contains-merge-commits because PR contains merge commits, which are not allowed in this repository.
Use git rebase to reapply your commits on top of the target branch. Detailed instructions for doing so can be found here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 16, 2026

k8s-ci-robot added the needs-priority label Mar 16, 2026

k8s-ci-robot requested review from fiunchinho and serngawy March 16, 2026 07:16

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 16, 2026

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Mar 16, 2026

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch 2 times, most recently from 962cb7e to ec3d921 Compare March 16, 2026 07:47

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Mar 16, 2026

AmitSahastra changed the title ~~Add ExistingLaunchTemplate (BYO) support for EKS managed node groups~~ feat: Add ExistingLaunchTemplate (BYO) support for EKS managed node groups Mar 16, 2026

AmitSahastra changed the title ~~feat: Add ExistingLaunchTemplate (BYO) support for EKS managed node groups~~ ✨ Add ExistingLaunchTemplate (BYO) support for EKS managed node groups Mar 16, 2026

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from ec3d921 to 10b2118 Compare March 17, 2026 09:02

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 17, 2026

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from 10b2118 to 02021ae Compare March 17, 2026 10:28

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Apr 10, 2026

serngawy reviewed Apr 10, 2026

View reviewed changes

Comment thread exp/api/v1beta1/types.go Outdated

Comment thread exp/api/v1beta2/types.go

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from d6487c5 to b292a1b Compare April 15, 2026 04:41

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 15, 2026

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from 459ba3d to 07c03fa Compare April 15, 2026 07:21

cPu1 reviewed Apr 15, 2026

View reviewed changes

Comment thread exp/webhooks/awsmanagedmachinepool_webhook.go Outdated

k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Apr 17, 2026

k8s-ci-robot added the do-not-merge/contains-merge-commits label May 11, 2026

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from 9572a9f to 1efed4e Compare May 20, 2026 12:53

k8s-ci-robot removed the do-not-merge/contains-merge-commits label May 20, 2026

k8s-ci-robot added the do-not-merge/contains-merge-commits label Jun 20, 2026

richardcase reviewed Jun 24, 2026

View reviewed changes

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from 8c80712 to 2b770c2 Compare June 24, 2026 16:43

kubernetes-prow Bot removed the do-not-merge/contains-merge-commits label Jun 24, 2026

AmitSahastra added 5 commits July 12, 2026 12:31

allow spec.instanceType alongside BYO launch template in EKS managed …

15b1fbc

…node groups

allow spec.amiType alongside BYO launch template in EKS managed node …

f842eb6

…groups

Fix unit test BYOMachinePoolSpec

83f22f8

AmitSahastra force-pushed the byo-launch-template-eks-nodegroup branch from 2b770c2 to 23cfe6a Compare July 12, 2026 07:07

richardcase requested review from Copilot and removed request for cPu1 July 21, 2026 14:25

Copilot started reviewing on behalf of richardcase July 21, 2026 14:25 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread test/e2e/data/eks/cluster-template-eks-managed-machinepool-with-byo-launch-template-only.yaml

Comment thread exp/api/v1beta2/types.go

Merge branch 'main' into byo-launch-template-eks-nodegroup

c58f25c

kubernetes-prow Bot added the do-not-merge/contains-merge-commits label Aug 10, 2026

Uh oh!

Conversation

AmitSahastra commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Mar 16, 2026

Uh oh!

k8s-ci-robot commented Mar 16, 2026

Uh oh!

AmitSahastra commented Apr 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

serngawy commented Apr 17, 2026

Uh oh!

k8s-ci-robot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jun 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kubernetes-prow Bot commented Jun 24, 2026

Uh oh!

richardcase commented Jul 21, 2026

Uh oh!

richardcase commented Jul 21, 2026

Uh oh!

richardcase commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

kubernetes-prow Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AmitSahastra commented Jul 27, 2026

Uh oh!

AmitSahastra commented Jul 27, 2026

Uh oh!

kubernetes-prow Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

AmitSahastra commented Mar 16, 2026 •

edited

Loading

k8s-ci-robot commented May 11, 2026 •

edited

Loading

kubernetes-prow Bot commented Jul 27, 2026 •

edited

Loading