Skip to content

NAP Fails to Provision

Symptom

Pods remain pending after NAP is enabled, and no suitable NAP-managed nodes appear even though workload demand should have triggered provisioning.

Possible Causes

  • Azure quota or regional capacity blocks the requested VM family.
  • No NodePool matches the pod's resource, taint, or affinity requirements.
  • The referenced AKSNodeClass is misconfigured.
  • Networking or identity prerequisites for NAP are not satisfied.
  • The cluster still depends on fixed-size pools for workloads that NAP rules do not cover.

Diagnosis Steps

flowchart TD
    A[NAP not provisioning nodes] --> B[Check pending pod scheduling reason]
    B --> C[Inspect NodePool and AKSNodeClass definitions]
    C --> D{Matching NodePool exists?}
    D -->|No| E[Fix requirements taints or limits]
    D -->|Yes| F[Check quota capacity and networking prerequisites]
    F --> G[Review karpenter-events and NodeClaims]
    G --> H[Fallback to fixed pool only if workload coverage is incomplete]

  1. Inspect the pending pod event stream.

    kubectl describe pod <pod-name> \
    --namespace <namespace>

  2. List NodePools and confirm at least one exists.

    kubectl get nodepools.karpenter.sh

  3. Inspect the matching NodePool and AKSNodeClass.

    kubectl describe nodepool.karpenter.sh <nodepool-name>

    kubectl describe aksnodeclass.karpenter.azure.com <aksnodeclass-name>

  4. Review Karpenter events.

    kubectl get events \
    --field-selector source=karpenter-events

  5. Confirm whether the workload actually matches NAP rules for SKU family, priority type, subnet expectations, and taints.

Resolution

  • Expand or correct NodePool requirements and limits.
  • Fix the AKSNodeClass reference, subnet, OS, or kubelet settings.
  • Request additional Azure quota or relax SKU family constraints.
  • Keep a fixed-size fallback pool temporarily while migrating workloads whose NAP rules are incomplete.

Prevention

  • Create mutually understandable NodePools instead of overlapping ambiguous ones.
  • Validate new NodePool and AKSNodeClass combinations with a synthetic pending workload.
  • Review quota and capacity assumptions before introducing new VM families.
  • Migrate from Cluster Autoscaler to NAP deliberately, not mid-incident.

See Also

Sources