Skip to main content

🛡️ AWS EKS managed node group Kubernetes version is unsupported or incompatible🟢

  • Contextual name: 🛡️ Managed node group Kubernetes version is unsupported or incompatible🟢
  • ID: /ce/ca/aws/eks/node-group-version-support
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Stats​

not available

Logic​

Description​

Open File

Description​

This policy checks whether an AWS EKS managed node group's configured Kubernetes minor version remains within the AWS EKS support lifecycle and is compatible with its cluster control plane. It allows versions in standard or extended support and supported version differences.

Rationale​

Managed node groups are not automatically upgraded when the control plane is upgraded, including AWS automatic upgrades after extended support ends. Nodes can retain a version beyond its final support deadline or fall outside the supported control plane compatibility range. These conditions warrant a planned node replacement to restore access to maintained Kubernetes releases and avoid API incompatibilities or workload failures.

AWS EKS provides 14 months of standard support followed by 12 months of extended support. Upstream Kubernetes end of life does not override AWS's support calendar. For the covered versions, kubelets must not be newer than the control plane and may be at most three minor versions older. Matching versions is an upgrade best practice, rather than a requirement for this check.

... see more

Remediation​

Open File

Remediation​

  1. Confirm the node group's Kubernetes version and the cluster control plane version against current AWS data:

    aws eks describe-nodegroup \
      --cluster-name <cluster> \
      --nodegroup-name <node-group> \
      --region <region>

    aws eks describe-cluster \
      --name <cluster> \
      --region <region>

    Inspect nodegroup.version, nodegroup.status, cluster.version, and cluster.status. Wait for any ongoing update to finish before starting another. Resolve inventory discrepancies before proceeding.

  2. Choose a Kubernetes version within AWS EKS standard or extended support that is no newer than the control plane and no more than three minor versions behind it. Prefer matching the control plane and remaining within standard support. If the node group is newer than the control plane, verify both versions before planning a control plane upgrade or replacing the group with compatible nodes.

  3. Test workload and add-on compatibility, review EKS upgrade insights and deprecated APIs, and reserve sufficient rollout capacity. Check Pod disruption budgets and draining requirements. If a control plane upgrade is necessary, advance one minor version at a time and follow the AWS upgrade sequence for nodes and add-ons. Plan recovery with compatible replacement capacity; do not rely on an in-place node group downgrade.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization39no data