Don't start kubelet if we are warming

nodeup/pkg/model/context.go

@@ -42,8 +42,13 @@ import (
 	"github.com/blang/semver/v4"
 )
 
+const (
+	ConfigurationModeWarming string = "Warming"
+)
+
 // NodeupModelContext is the context supplied the nodeup tasks
 type NodeupModelContext struct {
+	Cloud         fi.Cloud
 	Architecture  architectures.Architecture
 	Assets        *fi.AssetStore
 	Cluster       *kops.Cluster
@@ -62,6 +67,10 @@ type NodeupModelContext struct {
 
 	kubernetesVersion semver.Version
 	bootstrapCerts    map[string]*nodetasks.BootstrapCert
+
+	// ConfigurationMode determines if we are prewarming an instance or running it live
+	ConfigurationMode string
+	InstanceID        string
 }
 
 // Init completes initialization of the object, for example pre-parsing the kubernetes version

nodeup/pkg/model/kubelet.go

@@ -293,6 +293,11 @@ func (b *KubeletBuilder) buildSystemdService() *nodetasks.Service {
 
 	service.InitDefaults()
 
+	if b.ConfigurationMode == "Warming" {
+
+		service.Running = fi.Bool(false)
+	}
+
 	return service
 }
 
@@ -443,14 +448,7 @@ func (b *KubeletBuilder) buildKubeletConfigSpec() (*kops.KubeletConfigSpec, erro
 			instanceTypeName = *b.NodeupConfig.DefaultMachineType
 		}
 
-		region, err := awsup.FindRegion(b.Cluster)
+		awsCloud := b.Cloud.(awsup.AWSCloud)
-		if err != nil {
-			return nil, err
-		}
-		awsCloud, err := awsup.NewAWSCloud(region, nil)
-		if err != nil {
-			return nil, err
-		}
 		// Get the instance type's detailed information.
 		instanceType, err := awsup.GetMachineTypeInfo(awsCloud, instanceTypeName)
 		if err != nil {

pkg/model/iam/iam_builder.go

@@ -245,6 +245,7 @@ func (r *NodeRoleAPIServer) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
 	}
 
 	addMasterEC2Policies(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName())
+	addASLifecyclePolicies(p, resource, b.Cluster.GetName())
 	addCertIAMPolicies(p, resource)
 
 	var err error
@@ -348,6 +349,7 @@ func (r *NodeRoleNode) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
 	}
 
 	addNodeEC2Policies(p, resource)
+	addASLifecyclePolicies(p, resource, b.Cluster.GetName())
 
 	var err error
 	if p, err = b.AddS3Permissions(p); err != nil {
@@ -1009,10 +1011,34 @@ func addMasterASPolicies(p *Policy, resource stringorslice.StringOrSlice, legacy
 					},
 				},
 			},
+			&Statement{
+				Effect: StatementEffectAllow,
+				Action: stringorslice.Of(
+					"autoscaling:CompleteLifecycleAction",      // aws_manager.go
+					"autoscaling:DescribeAutoScalingInstances", // aws_instancegroups.go
+				),
+				Resource: resource,
+				Condition: Condition{
+					"StringEquals": map[string]string{
+						"autoscaling:ResourceTag/KubernetesCluster": clusterName,
+					},
+				},
+			},
 		)
 	}
 }
 
+func addASLifecyclePolicies(p *Policy, resource stringorslice.StringOrSlice, clusterName string) {
+	p.Statement = append(p.Statement,
+		&Statement{
+			Effect: StatementEffectAllow,
+			Action: stringorslice.Of(
+				"autoscaling:DescribeAutoScalingInstances",
+			),
+			Resource: resource,
+		})
+}
+
 func addCertIAMPolicies(p *Policy, resource stringorslice.StringOrSlice) {
 	// TODO: Make optional only if using IAM SSL Certs on ELBs
 	p.Statement = append(p.Statement, &Statement{

pkg/model/iam/tests/iam_builder_master_strict.json

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

pkg/model/iam/tests/iam_builder_master_strict_ecr.json

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

pkg/model/iam/tests/iam_builder_node_legacy.json

@@ -10,6 +10,13 @@
         "*"
       ]
     },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "s3:*"

pkg/model/iam/tests/iam_builder_node_strict.json

@@ -10,6 +10,13 @@
         "*"
       ]
     },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "s3:Get*"

pkg/model/iam/tests/iam_builder_node_strict_ecr.json

@@ -10,6 +10,13 @@
         "*"
       ]
     },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "s3:Get*"

tests/integration/update_cluster/apiservernodes/cloudformation.json

@@ -1160,6 +1160,13 @@
                 "*"
               ]
             },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "iam:ListServerCertificates",
@@ -1265,6 +1272,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1376,6 +1398,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_masters.minimal.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_nodes.minimal.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/bastionadditional_user-data/data/aws_iam_role_policy_masters.bastionuserdata.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "bastionuserdata.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/bastionadditional_user-data/data/aws_iam_role_policy_nodes.bastionuserdata.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/complex/cloudformation.json

@@ -1647,6 +1647,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "complex.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1758,6 +1773,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/complex/data/aws_iam_role_policy_masters.complex.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "complex.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/complex/data/aws_iam_role_policy_nodes.complex.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/compress/data/aws_iam_role_policy_masters.compress.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "compress.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/compress/data/aws_iam_role_policy_nodes.compress.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/containerd-custom/cloudformation.json

@@ -974,6 +974,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "containerd.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1085,6 +1100,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/containerd/cloudformation.json

@@ -974,6 +974,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "containerd.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1085,6 +1100,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/docker-custom/cloudformation.json

@@ -974,6 +974,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "docker.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1085,6 +1100,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/existing_sg/data/aws_iam_role_policy_masters.existingsg.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "existingsg.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/existing_sg/data/aws_iam_role_policy_nodes.existingsg.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/externallb/cloudformation.json

@@ -990,6 +990,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "externallb.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1101,6 +1116,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/externallb/data/aws_iam_role_policy_masters.externallb.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "externallb.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/externallb/data/aws_iam_role_policy_nodes.externallb.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/externalpolicies/data/aws_iam_role_policy_masters.externalpolicies.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "externalpolicies.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/externalpolicies/data/aws_iam_role_policy_nodes.externalpolicies.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/ha/data/aws_iam_role_policy_masters.ha.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "ha.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/ha/data/aws_iam_role_policy_nodes.ha.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/minimal-cloudformation/cloudformation.json

@@ -974,6 +974,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1085,6 +1100,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/minimal-gp3/cloudformation.json

@@ -970,6 +970,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1081,6 +1096,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/minimal-gp3/data/aws_iam_role_policy_masters.minimal.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/minimal-gp3/data/aws_iam_role_policy_nodes.minimal.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/minimal-json/data/aws_iam_role_policy_masters.minimal-json.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "minimal-json.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/minimal-json/data/aws_iam_role_policy_nodes.minimal-json.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/minimal/data/aws_iam_role_policy_masters.minimal.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/minimal/data/aws_iam_role_policy_nodes.minimal.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/mixed_instances/cloudformation.json

@@ -1677,6 +1677,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "mixedinstances.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1788,6 +1803,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/mixed_instances/data/aws_iam_role_policy_masters.mixedinstances.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "mixedinstances.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/mixed_instances/data/aws_iam_role_policy_nodes.mixedinstances.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/mixed_instances_spot/cloudformation.json

@@ -1678,6 +1678,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "mixedinstances.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1789,6 +1804,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/mixed_instances_spot/data/aws_iam_role_policy_masters.mixedinstances.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "mixedinstances.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/mixed_instances_spot/data/aws_iam_role_policy_nodes.mixedinstances.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/private-shared-ip/cloudformation.json

@@ -1469,6 +1469,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "private-shared-ip.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1580,6 +1595,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/private-shared-ip/data/aws_iam_role_policy_masters.private-shared-ip.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "private-shared-ip.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/private-shared-ip/data/aws_iam_role_policy_nodes.private-shared-ip.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/private-shared-subnet/data/aws_iam_role_policy_masters.private-shared-subnet.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "private-shared-subnet.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/private-shared-subnet/data/aws_iam_role_policy_nodes.private-shared-subnet.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatecalico/cloudformation.json

@@ -1614,6 +1614,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "privatecalico.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1725,6 +1740,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/privatecalico/data/aws_iam_role_policy_masters.privatecalico.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatecalico.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatecalico/data/aws_iam_role_policy_nodes.privatecalico.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatecanal/data/aws_iam_role_policy_masters.privatecanal.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatecanal.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatecanal/data/aws_iam_role_policy_nodes.privatecanal.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatecilium/cloudformation.json

@@ -1600,6 +1600,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "privatecilium.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1711,6 +1726,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/privatecilium/data/aws_iam_role_policy_masters.privatecilium.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatecilium.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatecilium/data/aws_iam_role_policy_nodes.privatecilium.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatecilium2/cloudformation.json

@@ -1600,6 +1600,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "privatecilium.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1711,6 +1726,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/privatecilium2/data/aws_iam_role_policy_masters.privatecilium.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatecilium.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatecilium2/data/aws_iam_role_policy_nodes.privatecilium.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privateciliumadvanced/cloudformation.json

@@ -1633,6 +1633,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "autoscaling:CompleteLifecycleAction",
+                "autoscaling:DescribeAutoScalingInstances"
+              ],
+              "Condition": {
+                "StringEquals": {
+                  "autoscaling:ResourceTag/KubernetesCluster": "privateciliumadvanced.example.com"
+                }
+              },
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "elasticloadbalancing:AddTags",
@@ -1764,6 +1779,13 @@
               "Resource": [
                 "*"
               ]
+            },
+            {
+              "Action": "autoscaling:DescribeAutoScalingInstances",
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
             }
           ],
           "Version": "2012-10-17"

tests/integration/update_cluster/privateciliumadvanced/data/aws_iam_role_policy_masters.privateciliumadvanced.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privateciliumadvanced.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privateciliumadvanced/data/aws_iam_role_policy_nodes.privateciliumadvanced.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatedns1/data/aws_iam_role_policy_masters.privatedns1.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatedns1.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatedns1/data/aws_iam_role_policy_nodes.privatedns1.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatedns2/data/aws_iam_role_policy_masters.privatedns2.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatedns2.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatedns2/data/aws_iam_role_policy_nodes.privatedns2.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privateflannel/data/aws_iam_role_policy_masters.privateflannel.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privateflannel.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privateflannel/data/aws_iam_role_policy_nodes.privateflannel.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privatekopeio/data/aws_iam_role_policy_masters.privatekopeio.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privatekopeio.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privatekopeio/data/aws_iam_role_policy_nodes.privatekopeio.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/privateweave/data/aws_iam_role_policy_masters.privateweave.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "privateweave.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/privateweave/data/aws_iam_role_policy_nodes.privateweave.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/public-jwks/data/aws_iam_role_policy_masters.minimal.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "minimal.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/public-jwks/data/aws_iam_role_policy_nodes.minimal.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/shared_subnet/data/aws_iam_role_policy_masters.sharedsubnet.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "sharedsubnet.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/shared_subnet/data/aws_iam_role_policy_nodes.sharedsubnet.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/shared_vpc/data/aws_iam_role_policy_masters.sharedvpc.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "sharedvpc.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/shared_vpc/data/aws_iam_role_policy_nodes.sharedvpc.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

tests/integration/update_cluster/unmanaged/data/aws_iam_role_policy_masters.unmanaged.example.com_policy

@@ -79,6 +79,21 @@
         "*"
       ]
     },
+    {
+      "Action": [
+        "autoscaling:CompleteLifecycleAction",
+        "autoscaling:DescribeAutoScalingInstances"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "autoscaling:ResourceTag/KubernetesCluster": "unmanaged.example.com"
+        }
+      },
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Action": [
         "elasticloadbalancing:AddTags",

tests/integration/update_cluster/unmanaged/data/aws_iam_role_policy_nodes.unmanaged.example.com_policy

@@ -9,6 +9,13 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Action": "autoscaling:DescribeAutoScalingInstances",
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ]
     }
   ],
   "Version": "2012-10-17"

upup/pkg/fi/nodeup/BUILD.bazel

@@ -28,6 +28,7 @@ go_library(
         "//util/pkg/vfs:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/aws:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/aws/session:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/service/autoscaling:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/service/ec2:go_default_library",
         "//vendor/k8s.io/klog/v2:go_default_library",
     ],

upup/pkg/fi/nodeup/command.go

@@ -49,6 +49,7 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"k8s.io/klog/v2"
 )
@@ -196,7 +197,24 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 		}
 	}
 
+	var cloud fi.Cloud
+
+	if api.CloudProviderID(c.cluster.Spec.CloudProvider) == api.CloudProviderAWS {
+		region, err := awsup.FindRegion(c.cluster)
+		if err != nil {
+			return err
+		}
+		awsCloud, err := awsup.NewAWSCloud(region, nil)
+
+		cloud = awsCloud
+
+		if err != nil {
+			return err
+		}
+	}
+
 	modelContext := &model.NodeupModelContext{
+		Cloud:         cloud,
 		Architecture:  architecture,
 		Assets:        assetStore,
 		Cluster:       c.cluster,
@@ -242,6 +260,19 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 		return err
 	}
 
+	if api.CloudProviderID(c.cluster.Spec.CloudProvider) == api.CloudProviderAWS {
+		instanceIDBytes, err := vfs.Context.ReadFile("metadata://aws/meta-data/instance-id")
+		if err != nil {
+			return fmt.Errorf("error reading instance-id from AWS metadata: %v", err)
+		}
+		modelContext.InstanceID = string(instanceIDBytes)
+
+		modelContext.ConfigurationMode, err = getAWSConfigurationMode(modelContext)
+		if err != nil {
+			return err
+		}
+	}
+
 	if err := loadKernelModules(modelContext); err != nil {
 		return err
 	}
@@ -295,7 +326,6 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 	}
 	// Protokube load image task is in ProtokubeBuilder
 
-	var cloud fi.Cloud
 	var target fi.Target
 	checkExisting := true
 
@@ -637,3 +667,29 @@ func getNodeConfigFromServer(ctx context.Context, config *nodeup.ConfigServerOpt
 	}
 	return client.QueryBootstrap(ctx, &request)
 }
+
+func getAWSConfigurationMode(c *model.NodeupModelContext) (string, error) {
+	// Only worker nodes and apiservers can actually autoscale.
+	// We are not adding describe permissions to the other roles
+	role := c.InstanceGroup.Spec.Role
+	if role != api.InstanceGroupRoleNode && role != api.InstanceGroupRoleAPIServer {
+		return "", nil
+	}
+
+	svc := c.Cloud.(awsup.AWSCloud).Autoscaling()
+
+	result, err := svc.DescribeAutoScalingInstances(&autoscaling.DescribeAutoScalingInstancesInput{
+		InstanceIds: []*string{&c.InstanceID},
+	})
+	if err != nil {
+		return "", fmt.Errorf("error describing instances: %v", err)
+	}
+	lifecycle := fi.StringValue(result.AutoScalingInstances[0].LifecycleState)
+	if strings.HasPrefix(lifecycle, "Warmed:") {
+		klog.Info("instance is entering warm pool")
+		return model.ConfigurationModeWarming, nil
+	} else {
+		klog.Info("instance is entering the ASG")
+		return "", nil
+	}
+}