EKS clusters whose managed node groups are all fixed in size
What does ZopNight detect here?
ZopNight flags an Amazon EKS cluster when none of its managed node groups can scale, meaning every group returned by `eks:DescribeNodegroup` has `minSize` equal to `maxSize`. Fargate-only clusters are skipped. Clusters that scale through Karpenter or EKS Auto Mode on a small fixed node group can be flagged wrongly; dismiss those findings.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-060 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Threshold | minSize = maxSize on all managed node groups |
| Source | ZopNight |
| Permissions used | eks:ListClusters · eks:ListNodegroups · eks:DescribeNodegroup |
Where it applies
Node capacity that cannot move
Kubernetes can add pods faster than a fixed fleet can hold them. The
EKS autoscaling page lists three
ways to scale nodes: EKS Auto Mode, which creates and consolidates nodes and builds on Karpenter;
Karpenter itself; and the Kubernetes Cluster Autoscaler, which works through Auto Scaling groups. For
managed node groups, the Cluster Autoscaler never scales a group below minSize or above maxSize,
so a group with equal values is pinned no matter what is installed. Pods that do not fit stay
Pending, and the headroom you keep to avoid that is paid for around the clock.
Checking node group sizes
CLUSTER=my-clusterfor ng in $(aws eks list-nodegroups --cluster-name "$CLUSTER" --query 'nodegroups[]' --output text); do aws eks describe-nodegroup --cluster-name "$CLUSTER" --nodegroup-name "$ng" \ --query 'nodegroup.[nodegroupName,scalingConfig.minSize,scalingConfig.maxSize]' --output textdoneAlso check for Karpenter or Auto Mode before acting:
kubectl get nodepools 2>/dev/nullThe node group test
ZopNight marks a cluster as autoscaling-enabled when at least one managed node group has a minimum size different from its maximum. The finding fires when that mark is explicitly false, meaning every managed node group is fixed. ZopNight has no setting to mark a cluster as scaled by something else, so a cluster whose node groups are all fixed is flagged whatever runs on it.
Clusters the rule cannot judge
Fargate-only clusters and Auto Mode clusters without managed node groups have no node group data, so the mark is never set and the rule stays silent.
The known blind spot is the AWS-documented pattern where Karpenter or EKS Auto Mode does the
scaling and its controller runs on a small managed node group with minSize equal to maxSize.
ZopNight cannot see the controller, so that cluster looks unscaled and is flagged. Dismiss the
finding once you have confirmed the controller handles scaling.
Why the estimate is $0
No saving is attached. The cost is capacity held for peak, or pods left unscheduled at peak.
Turning on node autoscaling
- Pick an approach: Cluster Autoscaler, Karpenter or EKS Auto Mode.
- For Cluster Autoscaler, deploy it and give each managed node group a
minSizelower than itsmaxSize, for example withaws eks update-nodegroup-config --cluster-name my-cluster --nodegroup-name NODEGROUP --scaling-config minSize=2,maxSize=10,desiredSize=2. - For Karpenter, install the controller and create NodePool and EC2NodeClass resources.
- For EKS Auto Mode, enable compute, block storage and load balancing in one request, which AWS
requires:
aws eks update-cluster-config --name my-cluster --compute-config enabled=true --kubernetes-network-config '{"elasticLoadBalancing":{"enabled":true}}' --storage-config '{"blockStorage":{"enabled":true}}'. - If Karpenter or Auto Mode already handles scaling, dismiss the finding in ZopNight.