My goal:
Upgrade our self-hosted Retool EKS cluster to Kubernetes 1.36, and more generally be able to keep the cluster on a Kubernetes version that is still in standard support without waiting on a blueprint release.
Issue:
modules/aws-eks/karpenter.tf in terraform-retool-self-hosted-blueprints pins the Karpenter chart to 1.12.0. Per Karpenter's compatibility matrix, Kubernetes 1.36 requires Karpenter >= 1.13:
So the blueprint currently caps a cluster at 1.35. The pin isn't exposed as a module input, so there's no supported way to work around it.
Two related pins in the same repo:
- cert-manager v1.11.0 — supports Kubernetes 1.21→1.27 and has been EOL since 2023-09-12, so it's outside its supported range on every version the blueprint can deploy. It does still work in practice, but it's had no security patches in nearly three years. Its only job here is issuing the ALB controller's webhook cert, which that chart can self-sign via enableCertManager: false.
- cluster_version defaults to 1.32, which left EKS standard support on 2026-03-22. A cluster created from that default today goes straight into extended support at 6x the control-plane rate, with no signal to the operator.
Could someone surface this to the engineering team maintaining that repository?
Retool version & hosting setup (Docker, K8s, cloud provider, etc.):
- Retool 4.0.12-stable, Helm chart 6.11.19
- Self-hosted on AWS EKS (ca-central-1), built from the official Terraform blueprint, modules at 0.3.5
- Currently Kubernetes 1.35
Error message(s) or screenshots:
No runtime error — we stopped at 1.35 rather than attempting 1.36, since the incompatibility is documented upstream by Karpenter. The blocker is the pin itself:
hcl
modules/aws-eks/karpenter.tf:8
version = "1.12.0"
Still 1.12.0 on the repo's main branch as of 2026-08-26.
What I've tried so far:
- Upgraded 1.32 → 1.33 → 1.34 → 1.35 on this blueprint. Three sequential hops, zero downtime, no trouble from Retool itself.
- Checked whether a blueprint upgrade would help — main (newer than the 0.3.5 release) still pins karpenter 1.12.0, cert-manager v1.11.0 and cluster_version = "1.32", so it doesn't.
- Checked for a module input to override the chart version — none exists for karpenter, cert-manager, aws-load-balancer-controller, external-secrets, metrics-server or reloader. The only toggles are enable_metrics_server and enable_ebs_csi_driver.
- Verified cert-manager v1.11.0 still reconciles on 1.33, 1.34 and 1.35 by issuing a throwaway Certificate against the blueprint's selfsigned issuer after each hop.
- Filed the detail as GitHub issue https://github.com/tryretool/terraform-retool-self-hosted-blueprints/issues/20.
The change we'd value most is exposing the cluster-addon chart versions as module inputs, so a compatibility gap stops being blocked on a blueprint release. That would also cover issues #15 and #16 on that repo, which look like the same root cause.
Happy to open a PR for any of it.
