Your clusters now support AWS Graviton

We now fully support running AWS Graviton nodes. Graviton is AWS’ own arm64 processor family, and its instances cost less per vCPU than the equivalent x86_64 (amd64) ones, so moving a workload lowers what you pay for its compute. First make sure your own workloads are multi-architecture and can run on arm64. Get in touch and we’ll help you plan a move, including the multi-architecture builds in your CI.

Our system nodes, which run the core platform workloads, now default to Graviton, unless one of our legacy workloads without arm64 support is still running (OpenVPN and HNC). Customers that have completed the migration path will automatically benefit from the lower cost of a Graviton system pool.

Moving your own node pools

Node pools take an architecture field:

  karpenter:
    node_pools:
      my-pool:
        node_class:
          architecture: arm64

It still defaults to amd64, so nothing moves until you choose to. When you set it, remove any kubernetes.io/arch entry under requirements: the architecture comes from this field now.

First check that every image landing on the pool has an arm64 build, both self-built and upstream:

docker manifest inspect <image> | grep architecture

Most upstream images do. The ones usually missed are init containers, sidecars, and the helper images Helm charts pull in without listing them in their values. A container without an arm64 build fails at start with exec format error, which looks like a broken image rather than a scheduling problem. To keep one workload on x86 while the rest of a pool moves, pin it with a nodeSelector on kubernetes.io/arch.

Our system pool defaults to Graviton

The system pool runs the components we manage for you: ingress, monitoring, certificate management, and so on. We’re rolling the switch out cluster by cluster. Karpenter replaces the pool’s nodes once, one at a time, respecting your PodDisruptionBudgets, and your own workloads don’t run on this pool, so nothing of yours is rescheduled.

Two components keep it on x86, as neither has an arm64 build: OpenVPN, which is being replaced by Tailscale or WireGuard, and the hierarchical namespaces controller, which upstream has retired. Nothing breaks while you are still on them, you just don’t see the saving yet.

Resources

• Karpenter, see “Choosing the CPU architecture”
• The component audit and reasoning behind this change are in our Roadmap item