EC2NodeClass Creation with Non-Existent Security Groups

[r-aju]

Description

Observed Behavior: The EC2NodeClass supports including security groups that don't exist. Karpenter creates the EC2NodeClass even when a security group doesn't exist, without validation

Expected Behavior: When creating an EC2NodeClass, Karpenter should validate that all specified security groups actually exist before proceeding with the creation. Ideally it should just use security group IDs and not allow anything else.

Reproduction Steps (Please include YAML):
EC2NodeClass is created successfully even with non-existent security groups.

apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: worker
spec:
  amiFamily: Bottlerocket
  amiSelectorTerms:
  - id: ami-xxxxxx
  - id: ami-xxxxxx
  associatePublicIPAddress: false
  blockDeviceMappings:
  - deviceName: /dev/xvda
    ebs:
      encrypted: true
      kmsKeyID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
      volumeSize: 4Gi
      volumeType: gp3
  detailedMonitoring: true
  kubelet:
    clusterDNS:
    - xx.xxx.x.xx
    maxPods: 110
  metadataOptions:
    httpEndpoint: enabled
    httpProtocolIPv6: disabled
    httpPutResponseHopLimit: 2
    httpTokens: required
  role: karpenter-node
  securityGroupSelectorTerms:
  - id: sg-xxxxxxxxxxxxxx
  - id: TBD-testing                                             # This SG doesn't exist
  - id: sg-xxxxxxxxxxxxxxxxx
  subnetSelectorTerms:
  - id: subnet-xxxxxxxxxxxxxxxxx
  - id: subnet-xxxxxxxxxxxxxxxxx
  - id: subnet-xxxxxxxxxxxxxxxxx
  tags:
    ENVIRONMENT: prod
    POD: infra
    SERVICE: eks
  userData: |
    [settings]
    [settings.host-containers.control]
    [settings.kernel.sysctl]
    'net.core.netdev_max_backlog' = '30000'

Versions:

• Chart Version: 1.6.2
• Kubernetes Version (kubectl version): 1.33

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[AndrewMitchell25]

I think that it could be useful to somehow let users know that the securityGroup doesn't exist, but I don't think we need to mark the nodeclass as not ready for it. What do you think about just adding the error with the ids of the nonexistent securityGroups to the nodeclass's securityGroup status?

[r-aju]

Thanks for the feedback. I do think keeping the NotReady condition makes sense here for the following reason:

Security groups act as the network firewall/gateway for any EC2 instance launched by Karpenter. If a referenced security group doesn't exist at the time the NodeClass is reconciled, any node provisioned from that NodeClass would either:

Launch with incomplete/unintended network access if AWS silently skips the missing SG.

That said, I'm happy to improve around it for example, we could keep the NotReady condition but also populate Status.SecurityGroups with the SGs that were found, so users can see what's valid alongside what's missing. Would that be a good middle ground.

I've raised a small PR around this which we can tweak accordingly: #9036