Help improve this page
To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.
Review release notes for Kubernetes versions on standard support
This topic gives important changes to be aware of for each Kubernetes version in standard support. When upgrading, carefully review the changes that have occurred between the old and new versions for your cluster.
Kubernetes 1.34
Kubernetes 1.34 is now available in Amazon EKS. For more information about Kubernetes 1.34, see the official release announcement
Important
-
Containerd updated to 2.1 in Version 1.34 for launch.
-
If you experience any issues after upgrade, check the containerd 2.1 release notes
.
-
-
AWS is not releasing an EKS-optimized Amazon Linux 2 AMI for Kubernetes 1.34.
-
AWS encourages you to migrate to Amazon Linux 2023. Learn how to Upgrade from Amazon Linux 2 to Amazon Linux 2023.
-
For more information, see Amazon Linux 2 AMI deprecation.
-
-
AppArmor is deprecated in Kubernetes 1.34.
-
We recommend migrating to alternative container security solutions like seccomp
or Pod Security Standards .
-
-
VolumeAttributesClass (VAC) graduates to GA in Kubernetes 1.34, migrating from the beta API (
storage.k8s.io/v1beta1) to the stable API (storage.k8s.io/v1).-
If you use the EBS CSI driver with AWS-managed sidecar containers (from CSI Components
on the ECR Gallery), volume modification will continue to work seamlessly on EKS 1.31-1.33 clusters. AWS will patch the sidecars to support beta VAC APIs until the end of EKS 1.33 standard support (July 29, 2026). -
If you self-manage your CSI sidecar containers, you may need to pin to older sidecar versions on pre-1.34 clusters to maintain VAC functionality.
-
To use GA VolumeAttributesClass features (such as modification rollback), upgrade to EKS 1.34 or later.
-
-
Dynamic Resource Allocation (DRA) Core APIs (GA): Dynamic Resource Allocation has graduated to stable, enabling efficient management of specialized hardware like GPUs through standardized allocation interfaces - simplifying resource management for hardware accelerators and improving utilization of specialized resources.
-
Projected ServiceAccount Tokens for Kubelet (Beta): This enhancement improves security by using short-lived credentials for container image pulls instead of long-lived secrets - reducing the risk of credential exposure and strengthening the overall security posture of your clusters.
-
Pod-level Resource Requests and Limits (Beta): This feature simplifies resource management by allowing shared resource pools for multi-container pods - enabling more efficient resource allocation and utilization for complex applications with multiple containers.
-
Mutable CSI Node Allocatable Count (Beta): The
MutableCSINodeAllocatableCountfeature gate is enabled by default in EKS 1.34, making the CSINode max attachable volume count attribute mutable and introducing a mechanism to update it dynamically based on user configuration at the CSI driver level. These updates can be triggered either by periodic intervals or by failure detection, enhancing the reliability of stateful pod scheduling by addressing mismatches between reported and actual attachment capacity on nodes.-
For more information, see Kubernetes v1.34: Mutable CSI Node Allocatable Count
on the Kubernetes Blog.
-
-
Deprecation Notice - cgroup driver configuration: Manual cgroup driver configuration is being deprecated in favor of automatic detection.
-
Customer impact: If you currently set the
--cgroup-driverflag manually in your kubelet configuration, you should prepare to remove this configuration. -
Required action: Plan to update node bootstrap scripts and custom AMI configurations to remove manual cgroup driver settings before the feature is removed in a future Kubernetes release.
-
For more information, see the cgroup driver documentation
.
-
For the complete Kubernetes 1.34 changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md
Kubernetes 1.33
Kubernetes 1.33 is now available in Amazon EKS. For more information about Kubernetes 1.33, see the official release announcement
Important
-
The Dynamic Resource Allocation beta Kubernetes API is enabled.
-
This beta API improves the experience of scheduling and monitoring workloads that require resources such as GPUs.
-
The beta API is defined by the Kubernetes community, and might change in future versions of Kubernetes.
-
Carefully review Feature stages
in the Kubernetes documentation to understand the implications of using beta APIs.
-
-
AWS is not releasing an EKS-optimized Amazon Linux 2 AMI for Kubernetes 1.33.
-
AWS encourages you to migrate to Amazon Linux 2023. Learn how to Upgrade from Amazon Linux 2 to Amazon Linux 2023.
-
For more information, see Amazon Linux 2 AMI deprecation.
-
-
In-Place Pod Resource Resize (Beta): In-place resource resize has been promoted to beta, allowing dynamic updates to CPU and memory resources for existing Pods without restarts - enabling vertical scaling of stateful workloads with zero downtime and seamless resource adjustments based on traffic patterns.
-
Sidecar Containers Now Stable: Sidecar containers have graduated to stable, implementing sidecars as special init containers with
restartPolicy: Alwaysthat start before application containers, run throughout the pod lifecycle, and support probes for operational state signaling.-
For more information, see Sidecar Containers
in the Kubernetes Documentation.
-
-
Endpoints API Deprecation: The Endpoints API is now officially deprecated and will return warnings when accessed - migrate workloads and scripts to use the EndpointSlices API instead, which supports modern features like dual-stack networking and handles multiple EndpointSlices per Service.
-
For more information, see Kubernetes v1.33: Continuing the transition from Endpoints to EndpointSlice
on the Kubernetes Blog.
-
-
Elastic Fabric Adapter Support: The default security group for Amazon EKS clusters now supports Elastic Fabric Adapter (EFA) traffic. The default security group has a new outbound rule that allows EFA traffic with the destination of the same security group. This allows EFA traffic within the cluster.
-
For more information, see Elastic Fabric Adapter for AI/ML and HPC workloads on Amazon EC2 in the Amazon Elastic Compute Cloud User Guide.
-
For the complete Kubernetes 1.33 changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.33.md
Kubernetes 1.32
Kubernetes 1.32 is now available in Amazon EKS. For more information about Kubernetes 1.32, see the official release announcement
Important
-
The
flowcontrol.apiserver.k8s.io/v1beta3API version of FlowSchema and PriorityLevelConfiguration has been removed in version1.32. If you are using these APIs, you must update your configurations to use the latest supported version before upgrading. -
ServiceAccount
metadata.annotations[kubernetes.io/enforce-mountable-secrets]has been deprecated in version1.32and will be removed in a future Kubernetes minor version release. It is recommended to use separate namespaces to isolate access to mounted secrets. -
Kubernetes version
1.32is the last version for which Amazon EKS will release Amazon Linux 2 (AL2) AMIs. From version1.33onwards, Amazon EKS will continue to release Amazon Linux 2023 (AL2023) and Bottlerocket based AMIs.
-
The Memory Manager feature has graduated to Generally Available (GA) status in Kubernetes version
1.32. This enhancement provides more efficient and predictable memory allocation for containerized applications, particularly beneficial for workloads with specific memory requirements. -
PersistentVolumeClaims (PVCs) created by StatefulSets now include automatic cleanup functionality. When PVCs are no longer needed, they will be automatically deleted while maintaining data persistence during StatefulSet updates and node maintenance operations. This feature simplifies storage management and helps prevent orphaned PVCs in your cluster.
-
Custom Resource Field Selector functionality has been introduced, allowing developers to add field selectors to custom resources. This feature provides the same filtering capabilities available for built-in Kubernetes objects to custom resources, enabling more precise and efficient resource filtering and promoting better API design practices.
For the complete Kubernetes 1.32 changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.32.md
Anonymous authentication changes
Starting with Amazon EKS 1.32, anonymous authentication is restricted to the following API server health check endpoints:
-
/healthz -
/livez -
/readyz
Requests to any other endpoint using the system:unauthenticated user will receive a 401 Unauthorized HTTP response. This security enhancement helps prevent unintended cluster access that could occur due to misconfigured RBAC policies.
Note
The public-info-viewer RBAC role continues to apply for the health check endpoints listed above.
Amazon Linux 2 AMI deprecation
Kubernetes version 1.32 is the last version for which Amazon EKS released AL2 AMIs. From version 1.33 onwards, Amazon EKS will continue to release AL2023 and Bottlerocket based AMIs. For more information, see Guide to EKS AL2 & AL2-Accelerated AMIs transition features.