🤖 EKSBot

🤖 EKSBot

@eksbot.bsky.social

Automatic posting of EKS related blog articles, software releases, etc. Not affiliated with AWS.

134 followers0 following700 posts

🤖 EKSBot
@eksbot.bsky.social

Measuring developer experience on an Amazon EKS developer platform #eks #kubernetes

aws.amazon.comMeasuring developer experience on an Amazon EKS developer platformMost platform teams can't prove their internal developer platform is improving software delivery. This post shows how to automatically collect the four DORA metrics (deployment frequency, lead time for changes, change failure rate, and failed deployment recovery time) on an Amazon EKS platform using Argo CD, Argo Rollouts, Apache DevLake, and Grafana.
🤖 EKSBot
@eksbot.bsky.social

kubernetes-sigs/aws-load-balancer-controller released v3.6.2 #eks #kubernetes

github.comkubernetes-sigs/aws-load-balancer-controller released v3.6.2⚠️ Upgrade Notes No CRD updates required. This is a patch release with no CRD changes. Upgrading the controller is sufficient. If you are coming from a release older than v3.6.0, apply the CRD steps from the v3.6.0 release notes first. 🔒 Security Controller image rebuilt on a base image that distrusts 5 certificate authorities The controller image is now built on eks-distro-minimal-base-nonroot:2026-10-23-1792785692.2023 (from 2026-07-27-1785178906.2023), which removes 5 distrusted eMudhra/emSign roots from the image CA bundle. Three were present and trusted in the previous base image -- emSign ECC Root CA - G3, emSign ECC Root CA - C3 and emSign Root CA - C1 -- taking the trusted root count from 143 to 140. This affects outbound TLS trust decisions made by the controller; there is no change to controller behavior or configuration. Upstream change: aws/eks-distro-build-tooling#2169. (#4937, @shraddhabang) github.com/klauspost/compress updated to v1.18.7 Addresses CVE-2026-63209, an out-of-bounds read in s2.NewDict. This is a test-only indirect dependency reached through the e2e suite (httpexpect -> fasthttp) and is not linked into the controller binary, so released images were not affected -- the bump keeps source-level dependency scanning clean. (#4937, @shraddhabang) 🔧 Enhancements and Fixes Gateway • Skip the redundant child-resource fan-out during the controller's initial cache sync. Create handlers for HTTPRoute, GRPCRoute, TCPRoute, TLSRoute, UDPRoute, ListenerSet, GatewayClass, ReferenceGrant, Service, LoadBalancerConfiguration, TargetGroupConfiguration and ListenerRuleConfiguration now return early when the event is part of the informer's initial list, since existing Gateways receive their own initial events and reconcile against the synced cache anyway. This reduces redundant reconcile enqueues at controller start-up, improving start-up time on clusters with many Gateway child resources. No behavioral change after start-up. (#4935, @zac-nixon) Misc • Formatting fix in the Ingress group reconciler and trailing-newline fixes across the Gateway e2e suites (#4935) What's Changed • perf(gw api): improve start up time by not enqueuing child resources by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4935 • cut v3.6.2 release by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4937 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.6.1...v3.6.2
🤖 EKSBot
@eksbot.bsky.social

aws/karpenter-provider-aws released v1.14.3 (LTS) #karpenter #eks #kubernetes

github.comaws/karpenter-provider-aws released v1.14.3 (LTS)🛡️ This is a Long-Term Support (LTS) release. Supported until Jul 2027. See SUPPORT.md for details. Bug Fixes • classify SpotMaxPriceTooLow as an ICE error (#9501, cherry-picked in #9787) • treat a reclaiming interruptible capacity reservation as unavailable capacity (#9703, cherry-picked in #9787) Continuous Integration • only bump patch version references in the release PR for patch releases (#9753) (#9762) #9762 (Ryan Mistretta) Chores • bump go to 1.26.10 and pin golangci-lint to v2.12.2 (release-v1.14.x) (#9759) #9759 (Derek Frank) • cherrypicks for v1.14.3 (#9787) #9787 (Derek Frank) Components Changelog • sigs.k8s.io/karpenter v1.14.3 • heal stranded unlaunched nodeclaim entries in cluster state (kubernetes-sigs/karpenter#3190) • relax minValues against narrowed NodeClaim requirements (kubernetes-sigs/karpenter#3170) • guard ReleaseNodeCount against a dropped NodePool entry (kubernetes-sigs/karpenter#3347) • bump go to 1.26.10 and golang.org/x/net to v0.60.0 (kubernetes-sigs/karpenter#3454)
🤖 EKSBot
@eksbot.bsky.social

Amazon EMR on EKS reduces EMR charge by 30 percent #eks #kubernetes

aws.amazon.comAmazon EMR on EKS reduces EMR charge by 30 percent<p>Amazon EMR announces a reduction of 30 percent in the EMR charge added to EKS when running EMR on EKS. This price decrease applies to both the per-vCPU-hour charge and the per-GB-hour charge, while the underlying Amazon EKS charges remain unchanged. All EMR workloads running on the EKS deployment option benefit from this change. Now, you can run Apache Spark workloads on Amazon Elastic Kubernetes Service (EKS) at a lower cost, and the new price automatically applies to your EMR on EKS workloads with no additional action required on your end.</p> <p>The 30% reduction in EMR on EKS pricing is available in all AWS Regions where Amazon EMR on EKS is available. To learn more about EMR on EKS, visit the <a href="https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks.html">Amazon EMR on EKS documentation</a> and the <a href="https://aws.amazon.com/emr/pricing/">Amazon EMR pricing page</a>.</p>
🤖 EKSBot
@eksbot.bsky.social

awslabs/amazon-eks-ami released AMI Release v20261019 #eks #kubernetes

github.comawslabs/amazon-eks-ami released AMI Release v20261019What's Changed • fix(al2023): disable update-motd timer by @lawraa in https://github.com/awslabs/amazon-eks-ami/pull/2857 • feat(al2027): minute adjustments (package removals and post-processor save paths) by @Youssef-Beltagy in https://github.com/awslabs/amazon-eks-ami/pull/2860 • fix(al2023): prevent truncated /etc/eks/pause.tar in AMIs by @lawraa in https://github.com/awslabs/amazon-eks-ami/pull/2858 • feat(nvidia): build-nvidia-drivers to rebuild NVIDIA kernel modules from sources staged in the AMI by @kummatty in https://github.com/awslabs/amazon-eks-ami/pull/2859 New Contributors • @lawraa made their first contribution in https://github.com/awslabs/amazon-eks-ami/pull/2857 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20261012...v20261019
🤖 EKSBot
@eksbot.bsky.social

aws/karpenter-provider-aws released v1.9.3 (LTS) #karpenter #eks #kubernetes

github.comaws/karpenter-provider-aws released v1.9.3 (LTS)🛡️ This is a Long-Term Support (LTS) release. Supported until Feb 2027. See SUPPORT.md for details. Continuous Integration • only bump patch version references in the release PR for patch releases (#9753) (#9761) #9761 (Ryan Mistretta) Chores • bump go to 1.26.10 and golang.org/x/net to v0.60.0, pin golangci-lint and controller-gen (release-v1.9.x) (#9760) #9760 (Derek Frank)
🤖 EKSBot
@eksbot.bsky.social

kubernetes-sigs/aws-load-balancer-controller released v3.6.1 #eks #kubernetes

github.comkubernetes-sigs/aws-load-balancer-controller released v3.6.1⚠️ Upgrade Notes No CRD updates required. This is a patch release with no CRD changes. Upgrading the controller is sufficient. If you are coming from a release older than v3.6.0, apply the CRD steps from the v3.6.0 release notes first. 🔒 Security Go toolchain and golang.org/x/net updated to clear 18 CVEs The controller image is now built with Go 1.26.10 (from 1.26.6) and golang.org/x/net v0.60.0 (from v0.58.0), resolving 18 vulnerabilities reported against the controller binary — 4 HIGH, 13 MEDIUM, 1 LOW. The Go patch covers 13 stdlib findings including CVE-2026-78667 (DoS via crafted HTTP Range headers), CVE-2026-78669 (DoS via excessive HTTP/2 SETTINGS frames) and CVE-2026-97031 (crypto/tls DoS via ECH outer extension references). The x/net bump covers 5 HTTP/2 findings (CVE-2026-78669, -78659, -78660, -78663, -97032) spanning flow-control bypass, trailer handling and HPACK encoder DoS. (#4933, @shraddhabang) No API, CRD or behavioral change — the go directive in go.mod remains at 1.26.5, so the minimum version for module consumers is unchanged. 🚀 What's New Per-resource reconcile condition metric A new awslbc_controller_reconcile_condition gauge reports whether the last reconcile of each individual resource succeeded (1) or failed (0), labelled by controller, namespace and name. Wired across the Ingress, Service, Gateway, TargetGroupBinding and GlobalAccelerator reconcilers. (#4812, @gurpalw) Node Ready time exposed on pod endpoints PodEndpoint now carries NodeReadyTime, the LastTransitionTime of the pod's node Ready condition. (#4932, @zac-nixon) 🔧 Enhancements and Fixes Networking • Treat InvalidGroup.NotFound as success when releasing the auto-generated backend security group — a group already deleted out-of-band no longer fails the reconcile, it is logged and the cached ID cleared (#4928) Mutual authentication • Move the mTLS config parsing helpers out of the Ingress listener model builder into pkg/shared_utils, so Gateway and Ingress share one implementation (ParseMtlsConfigEntries). Pure refactor, no behavior change (#4918) 📖 Documentation Updates • Document the new awslbc_controller_reconcile_condition gauge in the Prometheus metrics guide, with an example query for finding resources that are failing to reconcile (#4812) What's Changed • fix(scripts): eks-charts sync gh CLI compat + docs version bump by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4922 • fix(networking): treat InvalidGroup.NotFound as success in releaseSG by @nakshah87 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4928 • Move mutual auth helpers to shared utils by @bobert-2 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4918 • feat(metrics): add per-resource reconcile condition gauge by @gurpalw in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4812 • feat(backend): expose node Ready time on pod endpoints by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4932 • build(deps): bump go to 1.26.10 and golang.org/x/net to v0.60.0 by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4933 • cut v3.6.1 release by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4934 New Contributors • @nakshah87 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4928 • @gurpalw made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4812 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.6.0...v3.6.1
🤖 EKSBot
@eksbot.bsky.social

awslabs/amazon-eks-ami released AMI Release v20261012 #eks #kubernetes

github.comawslabs/amazon-eks-ami released AMI Release v20261012What's Changed • ci: cut runner quota use with schedules, concurrency and timeouts by @shvbsle in https://github.com/awslabs/amazon-eks-ami/pull/2851 • feat(al2027): unpin kernel minor version during public preview by @Youssef-Beltagy in https://github.com/awslabs/amazon-eks-ami/pull/2853 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20261003...v20261012
🤖 EKSBot
@eksbot.bsky.social

aws/karpenter-provider-aws released v1.15.0 #ec2 #karpenter #eks #kubernetes

github.comaws/karpenter-provider-aws released v1.15.0Features (core) • dra prioritized alternatives support (#3142) #3142 (Ryan Mistretta) • metrics: add karpenter_pods_disrupted_total counter (#3015) #3015 (praveen9354) • metrics: add consolidation_policy and termination_mode labels to disruption metrics (#3179) #3179 (Derek Frank) • add VPA prediction controller and store (#3134) #3134 (Jigisha Patil) • default pod topology spread awareness (#3205) #3205 (Andrew Mitchell) • account for instance type volume limits when provisioning (#3202) #3202 (Eddie) • Reduce allocations of Requirement and Requirements (#3211) #3211 (Bevan Arps) • metrics: document metric dimensions with built-in help and values (#3295) #3295 (Derek Frank) • metrics: split the disruption decision dimension into command vs approval decisions (#3322) #3322 (Derek Frank) • metrics: name and document the unknown cloudprovider error value (#3323) #3323 (Derek Frank) • disruption: Add pod disruption tracking to perf test reporting (#2892) #2892 (Nathaniel Jones) • node repair as voluntary disruption (#3311) #3311 (Derek Frank) • terminate first drift for capacity constrained nodepools (#3312) #3312 (Derek Frank) • publish pod event for insufficient capacity error (#3143) #3143 (Tsubasa Nagasawa) • terminate-first repair for capacity-constrained NodePools (#3342) #3342 (Derek Frank) • reboot as a node action (#3345) #3345 (Sarthak Umarani) • Add feature-gated pod deletion cost management controller (#2894) #2894 (Nathaniel Jones) • integrate reason-aware matching with voluntary node repair (#3336) #3336 (Sebestien) • integrate node repair candidate resolution and escalation (#3367) #3367 (Sebestien) • wire reboot into repair (#3377) #3377 (Sarthak Umarani) • repair registered nodes that never initialize through the repair disruption method (#3393) #3393 (Derek Frank) • add --legacy-node-repair to run the legacy node repair controller in place of the repair disruption method (#3400) #3400 (Derek Frank) • add metric for terminate-first decisions labeled by why the replacement couldn't be staged first (#3404) #3404 (Derek Frank) • always run the reboot controller and fail terminal reboot errors immediately (#3405) #3405 (Sarthak Umarani) (provider) • add aws specific feature gates implementation with --aws-feature-gates flag (#9482) #9482 (Joshua Guo) • CEL expression support for maxPodsExpression, kubeReserved, and systemReserved (#9326) #9326 (Zara) • Extending KubeletConfiguration struct fields (#9461) #9461 (Zara) • expose security group refresh interval as configurable setting (#9526) #9526 (Derek Frank) • metrics: bump to the label-aware core and document provider metric dimensions (#9595) #9595 (Derek Frank) • add EC2NodeClass support for Nitro Enclaves #8165 (Sebestien Palmerio) • decouple reserved offering Available from ReservationCapacity (#9625) #9625 (Derek Frank) • add Helm values and docs for the PodDeletionCostManagement feature gate (#9653) #9653 (Derek Frank) • implement CloudProvider.Reboot via ec2:RebootInstances (#9676) #9676 (Sarthak Umarani) • reason-aware default repair policies with bounded termination grace periods (#9680) #9680 (Sebestien) • nvidia and efa driver dra support (#9550) #9550 (Joshua Guo) • bump karpenter to support --legacy-node-repair, add settings.legacyNodeRepair to the chart, and document it (#9709) #9709 (Derek Frank) • add the RebootForRepair AWS feature gate for reboot repair policies (#9716) #9716 (Sarthak Umarani) Bug Fixes (core) • fix capacity and overhead override semantic (#3151) #3151 (Jigisha Patil) • heal stranded unlaunched nodeclaim entries in cluster state (#3190) #3190 (Ryan Mistretta) • Filter out incompatible Offerings in EstimatedSavings() (#3217) #3217 (Drew Sirenko) • propagate template labels to virtual buffer pods (#3174) #3174 (Jigisha Patil) • check for nodename and terminal pod for PodSchedulingUndecidedTimeSeconds gauge delete (#3120) #3120 (Joshua Guo) • relax minValues against narrowed NodeClaim requirements (#3170) #3170 (Karan V) • adding dynamic resources field to nodeoverlay apply (#3278) #3278 (Joshua Guo) • pass ctx to disruption.NewController in terminatefirst_test (#3346) #3346 (Sarthak Umarani) • record terminate-first under the voluntary disruption decision label (#3348) #3348 (Derek Frank) • handle not found error for node lookup in eviction queue (#3335) #3335 (Cameron McAvoy) • guard ReleaseNodeCount against a dropped NodePool entry (#3347) #3347 (GaneshBannur) • add nodepool label to cloud provider errors (#3269) #3269 (Cindia-blue) • size repair replacements for pods whose eviction is blocked (#3358) #3358 (Derek Frank) • add nodepool label to Reboot error metrics and expect unknown error label in tests (#3359) #3359 (Sarthak Umarani) • don't record a reboot's terminal metrics twice on a stale reconcile (#3360) #3360 (Sarthak Umarani) • capacity buffer: fix trigger when cb is deleted (#3298) #3298 (Zachary Nixon) • disruption: emit DisruptionBlocked when static drift can't stage a replacement at the node limit (#3368) #3368 (Derek Frank) • keep the reboot watch predicate from writing conditions into the cached NodeClaim (#3372) #3372 (Derek Frank) • let residual pods ride a bounded reboot instead of deleting them (#3379) #3379 (Sarthak Umarani) • capacity buffer: watch scalableRef workloads so buffers resolve as soon as their workload exists (#3370) #3370 (Derek Frank) • correct go.tools.sum checksum for envoyproxy/go-control-plane/envoy v1.32.3 (#3388) #3388 (Sebestien) • only repair uninitialized nodes once they register (#3397) #3397 (Derek Frank) • terminate-first static repair and drift when capacity reservations are full (#3398) #3398 (Derek Frank) • skip a static NodePool whose instance types can't be resolved instead of aborting repair and drift (#3403) #3403 (Derek Frank) • bound the drain when a failed reboot escalates to replacement (#3407) #3407 (Sarthak Umarani) • use the same timestamp to score all repair candidates (#3406) #3406 (GaneshBannur) (provider) • evict stale instance cache entries in List() (#9242) #9242 (Ryan Mistretta) • classify SpotMaxPriceTooLow as an ICE error (#9501) #9501 (Sandeep Raju) • key offering cache on nestedVirtualizationEnabled (#9682) #9682 (Ryan Mistretta) • treat a reclaiming interruptible capacity reservation as unavailable capacity (#9703) #9703 (Ryan Mistretta) • credit a terminated instance's capacity reservation slot only once (#9704) #9704 (Ryan Mistretta) • raise Bottlerocket default root volume to 6Gi (#9700) #9700 (Ryan Mistretta) • use the pre-1.15 repair policies with --legacy-node-repair (#9717) #9717 (Derek Frank) Documentation (core) • reference rfc-template.md in designs README (#3173) #3173 (Andrew Mitchell) • add drift-per-nodepool-backoff rfc (#3128) #3128 (Cameron McAvoy) • fix typos in contributing-guidelines.md (#3161) #3161 (Mridula Madabhushanam) • Initial AGENTS.md (#3232) #3232 (Reed Schalo) • RFC for default pod topology spread awareness (#3183) #3183 (Andrew Mitchell) • add community maintained upcloud providers (#3309) #3309 (Leonardo) • add AI disclosure section to PR template (#3334) #3334 (Drew Sirenko) • RFC for making node repair voluntary disruption (#3192) #3192 (Derek Frank) • RFC for Terminate-first Disruption for Capacity-Constrained Nodepools (#3203) #3203 (Derek Frank) • RFC for reboot as a node action in karpenter (#3259) #3259 (Sarthak Umarani) • RFC for Node Repair Veto (#3277) #3277 (GaneshBannur) • RFC for building a pod deletion cost controller to enable Karpenter to work better with the ReplicaSet Controller (#2935) #2935 (Nathaniel Jones) • add reason-aware repair policy matching RFC (#3263) #3263 (Sebestien) • document well known annotations as wellknown.Annotations (#3364) #3364 (Derek Frank) • add node repair candidate resolution, admission, and escalation RFC (#3270) #3270 (Sebestien) • document feature gates as options.FeatureGates (#3376) #3376 (Derek Frank) • remove consolidationPolicy default sentence from NodePool API docs (#3378) #3378 (Drew Sirenko) (provider) • update broken link to Node Repair heading on Disruption Concepts page (#8993) #8993 (Seth McCombs) • add g6f fractional GPU NodeOverlay workaround example (#9395) #9395 (Zaid Ahmed Farooq) • add conceptual documentation for NodeClaims (#9125) #9125 (Sergiy) • add version support policy (#9313) #9313 (Sergiy) • RFC for CEL expressions in kubelet config fields (#9342) #9342 (Zara) • fix invalid eksctl flag in Zonal Shift onboarding (#9495) #9495 (Sandipan Panda) • consolidate status condition, NodeOverlay, and minValues fixes (#9500) #9500 (Ryan Mistretta) • add status condition, NodeOverlay, and minValues fixes to /docs (#9502) #9502 (Ryan Mistretta) • CEL Expressions and Extended Kubelet Configuration feature site docs (#9508) #9508 (Zara) • update for patch release v1.14.1 (#9533) #9533 (Ryan Mistretta) • add task for monitoring API throttling (#9534) #9534 (Derek Frank) • add ca rotation warning (#9522) #9522 (Joshua Guo) • note the reason metric label casing change in the 1.15 upgrade guide (#9581) #9581 (Derek Frank) • metrics: docs generator reads []opmetrics.Label and Stage; regenerate metrics.md (#9604) #9604 (Derek Frank) • note the 1.15 breaking cloudprovider error label change ("" -> "unknown") (#9600) #9600 (Derek Frank) • recommend MostAllocated (#9603) #9603 (Derek Frank) • document node repair as a voluntary disruption method (#9635) #9635 (Derek Frank) • add kubectl examples to inspect NodePools, EC2NodeClasses, and NodeClaims (#9588) #9588 (Daniel Bae) • document terminate-first disruption for drift and repair (#9655) #9655 (Derek Frank) • clarify DaemonSet overhead is used for sizing, not reserved (#9442) #9442 (Vincent Creusot) • fix typos in concepts documentation (#9429) #9429 (Archong Liu) • Node Pool -> NodePool (#9651) #9651 (Ben Bodenmiller) • note that metric dimensions can be empty depending on object state (#9657) #9657 (Derek Frank) • add guidance for exposing instance configuration through offerings (#9640) #9640 (Jason Deal) • generate a well known annotations reference from wellknown.Annotations (#9669) #9669 (Derek Frank) • clarify NodeOverlay hourly price units (#9478) #9478 (Mia Miao) • instance-family plus instance-size can collapse to one SKU (#9556) #9556 (Andrey Maltsev) • restricted runtime labels do not trigger provisioning (#9555) #9555 (Andrey Maltsev) • warn about consolidation candidate ordering change in 1.14 upgrade guide (#9695) #9695 (Derek Frank) • regenerate the metrics reference for the reboot disruption decision #9691 (Sarthak Umarani) • add 1.15 consolidation_type upgrade note, security group refresh interval, and consolidateAfter default (#9715) #9715 (Derek Frank) • order the 1.15.0 upgrade guide by impact and document the ordering in AGENTS.md (#9712) #9712 (Derek Frank) • document the do-not-repair DisruptionBlocked event (#9698) #9698 (GaneshBannur) Performance Improvements (core) • cache virtual pod definitions to prevent re-computation (#3137) #3137 (Zachary Nixon) • rewrite Requirements.intersectKeys to avoid allocations (#3310) #3310 (Wiktor Kuropatwa) • repair: match repair policies on Node updates instead of every disruption pass (#3381) #3381 (Derek Frank) (provider) • precompute offering cache keys (#9411) #9411 (Ryan Mistretta) Tests (core) • add per-test-case performance threshold overrides (#3165) #3165 (Andrew Mitchell) • add microbenchmarks for NewScheduler and NewTopology (#3299) #3299 (Ryan Mistretta) • add catch for pod not found (#3315) #3315 (Ryan Mistretta) • change foreground deletion to background (#3316) #3316 (Ryan Mistretta) • add regression test for default pod tscs (#3274) #3274 (Andrew Mitchell) • kwok: node repair + budgeted-breaker regression suite (#3357) #3357 (Derek Frank) • disruption: cover terminate-first drift and repair (#3362) #3362 (Sebestien) • e2e: patch repair fault conditions so stale node reads can't drop do not repair (#3371) #3371 (Derek Frank) • add reboot e2e specs (#3380) #3380 (Sarthak Umarani) • compare snapshotted container restarts across sequential runs (#3339) #3339 (Ryan Mistretta) • perf: gate Karpenter memory on Go live heap instead of RSS (#3382) #3382 (Sebestien) • raise reboot escalation e2e timeout to 35m (#3396) #3396 (Ryan Mistretta) (provider) • bump IODCR interruption notice period (#9543) #9543 (Ryan Mistretta) • drop stale testing for unmanaged and managed instance profile (#9545) #9545 (Ryan Mistretta) • Adding E2E Tests for Zonal Shift provider. (#9221) #9221 (sagdhana) • use g.Expect in ExpectInterruptibleAndSourceCapacityCanceled (#9609) #9609 (Ryan Mistretta) • bump upgrade suite from_git_ref pin (#9607) #9607 (Drew Sirenko) • fix IPv6 e2e by disabling vpc-cni subnet discovery (#9608) #9608 (Drew Sirenko) • compare nodes by UID in e2e Monitor created/deleted node tracking (#9631) #9631 (Derek Frank) • run core disruption and repair suites upstream and fix repair e2es for voluntary repair (#9647) #9647 (Derek Frank) • cover terminate-first drift and repair on a full capacity reservation #9654 (Sebestien Palmerio) • use the initialized node in repair condition e2es (#9675) #9675 (Sebestien) • fit repair e2es inside their timeouts now that core clamps condition transition times to node creation (#9687) #9687 (Derek Frank) • inject reason-matched repair faults so repair e2es hit the 10 minute XID policy #9692 (Derek Frank) • run the reboot e2e specs on EC2 #9691 (Sarthak Umarani) • move repair and reboot e2es into their own Repair suite and bump Go to 1.26.9 for vulncheck (#9699) #9699 (Derek Frank) • use >1 vCPU instances and a 20m timeout for Windows kubelet e2e specs (#9701) #9701 (Ryan Mistretta) • e2es: enable DRA NVIDIA/EFA feature gates and stop ignoring DRA requests (#9708) #9708 (Ryan Mistretta) • fall back across random instance types and zones when creating E2E capacity reservations (#9707) #9707 (Derek Frank) • fix flaky zonal shift test #9710 (Ryan Mistretta) • add back in legacy repair e2es (#9714) #9714 (Ryan Mistretta) • e2e for terminate-first static repair and drift with a full capacity reservation (#9706) #9706 (Derek Frank) Continuous Integration • unit test and ci fix for dl1.24xlarge does not exist error (#9343) #9343 (Joshua Guo) • pin all release/CI build tooling to explicit versions (#9396) #9396 (Derek Frank) • fix flaky should use same launch template (#9459) #9459 (Ryan Mistretta) • fix the website preview workflow (#9515) #9515 (Joshua Guo) • fixing the broken fixed website preview workflow (#9530) #9530 (Joshua Guo) • harden website preview workflow's artifact handling (#9587) #9587 (GaneshBannur) • collapse per-suite periodic e2e Slack pings into one run summary (#9589) #9589 (Drew Sirenko) • Add read perms to e2e-matrix-trigger (#9596) #9596 (Drew Sirenko) • install the go.mod Go version in the private cluster CodeBuild job (#9671) #9671 (Derek Frank) • bump eksctl to v0.217.0 for E2E (#9672) #9672 (Derek Frank) • upgrade from the latest release in the E2E Upgrade suite (#9677) #9677 (Derek Frank) • keep the GitHub "Latest" release badge on the newest version (#9397) #9397 (Derek Frank) • fix private cluster e2e helm, prometheus webhook image, and zonal shift endpoint (#9679) #9679 (Derek Frank) • run required checks in the merge queue (#9681) #9681 (Derek Frank) • deploy website previews on /karpenter preview instead of every PR push (#9686) #9686 (Derek Frank) • give the IPv6 vpc-cni addon a pod identity so eksctl v0.217.0 can create E2E clusters (#9688) #9688 (Derek Frank) • use IRSA for Karpenter on IPv6 E2E clusters so eksctl skips the vpc-cni pod identity (#9689) #9689 (Derek Frank) Chores (core) • complete operator enum validation for NodeSelectorRequirement (#2924) #2924 (Leo Ryu) • default consolidateAfter instead of requiring it (#3220) #3220 (Ryan Mistretta) • Consolidate pod force-deletion into the eviction queue (#3063) #3063 (Ketankumar Jani) • upgrade KWOK to v0.8.0 (#3140) #3140 (Kotaro Inoue) • clean up agents.md (#3264) #3264 (Todd Neal) • controllers: standardize Name() to a string literal (#3268) #3268 (Derek Frank) • use c.Name() for deviceallocation controller (#3283) #3283 (Derek Frank) • improve controller error context (#3280) #3280 (Sebestien) • breaking: standardize the reason metric label to lowercase values (#3284) #3284 (Derek Frank) • Sync sig-autoscaling-leads aliases (#3293) #3293 (Daniel Kłobuszewski) • breaking: set the queue_failures_total consolidation_type label to the command's consolidation type instead of its decision string (#3294) #3294 (Derek Frank) • add dynamic_resources dimensions on pod metrics (#3286) #3286 (Ryan Mistretta) • add stage field to metrics (#3321) #3321 (Ryan Mistretta) • Add ryan-mist as reviewer (#3324) #3324 (Ryan Mistretta) • add jigish620 as karpenter reviewer (#3325) #3325 (Jigisha Patil) • push to PR cancels PRs inflight runs (#3349) #3349 (Ryan Mistretta) • replace avast/retry-go with k8s wait utility (#2968) #2968 (Mikel Olasagasti Uranga) • remove unused compatibility.karpenter.sh/provider annotation (#3375) #3375 (Derek Frank) • don't register the VPA prediction controller until predictions are wired in (#3383) #3383 (Jigisha Patil) • emit DisruptionBlocked when do-not-repair vetoes repair (#3390) #3390 (GaneshBannur) • bump go to 1.26.9 and golang.org/x/net to v0.60.0 to fix vulncheck (#3392) #3392 (Derek Frank) (provider) • Release v1.14.0 (#9344) #9344 (github-actions[bot]) • deps: bump the go-deps group with 12 updates (#9365) #9365 (dependabot[bot]) • deps: consolidated dependabot dependency bump (#9389) #9389 (Andrew Mitchell) • deps-dev: bump postcss from 8.5.18 to 8.5.19 in /website in the website-deps group across 1 directory (#9391) #9391 (dependabot[bot]) • NodeClass status condition on misconfigured spec.instanceProfile (#9390) #9390 (Ryan Mistretta) • Use ec2 api to filter instances (#9408) #9408 (ahreehong) • deps: bump actions/setup-go from 6.5.0 to 7.0.0 in /.github/actions/install-deps in the action-deps group (#9430) #9430 (dependabot[bot]) • deps: bump actions/setup-go from 6.5.0 to 7.0.0 in /.github/actions/e2e/cleanup in the action-deps group (#9432) #9432 (dependabot[bot]) • deps-dev: bump the website-deps group in /website with 2 updates (#9431) #9431 (dependabot[bot]) • deps: bump the actions-deps group with 4 updates (#9433) #9433 (dependabot[bot]) • Update data from AWS APIs (#9435) #9435 (github-actions[bot]) • deps: bump the go-deps group with 12 updates (#9434) #9434 (dependabot[bot]) • deps: bump golang.org/x/text to v0.39.0 to fix GO-2026-5970 (#9439) #9439 (Derek Frank) • deps-dev: bump tar from 7.5.16 to 7.5.20 in /website (#9436) #9436 (dependabot[bot]) • deps: bump the go-deps group with 15 updates (#9453) #9453 (dependabot[bot]) • deps: bump github.com/google/cel-go from 0.26.0 to 0.29.0 (#9458) #9458 (dependabot[bot]) • deps: bump docker/login-action from 4.4.0 to 4.5.1 in /.github/actions/e2e/run-tests-private-cluster in the action-deps group (#9451) #9451 (dependabot[bot]) • deps-dev: bump postcss from 8.5.20 to 8.5.23 in /website in the website-deps group (#9450) #9450 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 in /.github/actions/e2e/dump-logs in the action-deps group (#9447) #9447 (dependabot[bot]) • deps: bump actions/checkout from 7.0.0 to 7.0.1 in /.github/actions/e2e/install-prometheus in the action-deps group (#9449) #9449 (dependabot[bot]) • deps: bump actions/checkout from 7.0.0 to 7.0.1 in /.github/actions/e2e/setup-cluster in the action-deps group (#9448) #9448 (dependabot[bot]) • deps: bump the action-deps group in /.github/actions/e2e/upgrade-crds with 2 updates (#9446) #9446 (dependabot[bot]) • deps: bump actions/checkout from 7.0.0 to 7.0.1 in /.github/actions/e2e/slack/notify in the action-deps group (#9444) #9444 (dependabot[bot]) • deps: bump actions/checkout from 7.0.0 to 7.0.1 in /.github/actions/e2e/cleanup in the action-deps group (#9443) #9443 (dependabot[bot]) • deps: bump the action-deps group in /.github/actions/e2e/install-karpenter with 2 updates (#9445) #9445 (dependabot[bot]) • deps: bump the actions-deps group with 6 updates (#9452) #9452 (dependabot[bot]) • deps: bump the actions-deps group with 5 updates (#9472) #9472 (dependabot[bot]) • deps: bump the go-deps group with 14 updates (#9473) #9473 (dependabot[bot]) • Update data from AWS APIs (#9480) #9480 (github-actions[bot]) • deps-dev: bump postcss from 8.5.23 to 8.5.25 in /website in the website-deps group (#9469) #9469 (dependabot[bot]) • deps: bump docker/login-action from 4.5.1 to 4.6.0 in /.github/actions/e2e/install-karpenter in the action-deps group (#9470) #9470 (dependabot[bot]) • deps: bump docker/login-action from 4.5.1 to 4.6.0 in /.github/actions/e2e/run-tests-private-cluster in the action-deps group (#9471) #9471 (dependabot[bot]) • deps: bump the actions-deps group with 3 updates (#9493) #9493 (dependabot[bot]) • deps: bump the go-deps group with 16 updates (#9494) #9494 (dependabot[bot]) • deps-dev: bump postcss from 8.5.25 to 8.5.26 in /website in the website-deps group (#9491) #9491 (dependabot[bot]) • deps: bump the k8s-go-deps group across 1 directory with 7 updates (#9492) #9492 (dependabot[bot]) • bump go to 1.26.6 (#9506) #9506 (Ryan Mistretta) • deps: bump the go-deps group with 17 updates (#9513) #9513 (dependabot[bot]) • deps-dev: bump ansi-regex from 6.2.2 to 6.3.0 in /website in the website-deps group (#9511) #9511 (dependabot[bot]) • deps: bump the actions-deps group with 3 updates (#9512) #9512 (dependabot[bot]) • Update data from AWS APIs (#9514) #9514 (github-actions[bot]) • add nodeclass user data size metric and better user data size error handling (#9483) #9483 (Joshua Guo) • deps: bump the action-deps group in /.github/actions/deploy-website with 2 updates (#9527) #9527 (dependabot[bot]) • deps: bump the actions-deps group with 2 updates (#9528) #9528 (dependabot[bot]) • deps: bump the go-deps group with 14 updates (#9529) #9529 (dependabot[bot]) • Update data from AWS APIs (#9537) #9537 (github-actions[bot]) • deps: bump the go-deps group with 14 updates (#9541) #9541 (dependabot[bot]) • deps: bump the actions-deps group with 3 updates (#9540) #9540 (dependabot[bot]) • deps: bump the k8s-go-deps group with 6 updates (#9539) #9539 (dependabot[bot]) • bump sigs.k8s.io/karpenter and adapt to its API changes (#9544) #9544 (Andrew Mitchell) • Update data from AWS APIs (#9559) #9559 (github-actions[bot]) • deps: bump the go-deps group with 16 updates (#9565) #9565 (dependabot[bot]) • deps: bump the actions-deps group with 3 updates (#9564) #9564 (dependabot[bot]) • deps: bump the k8s-go-deps group across 1 directory with 6 updates (#9563) #9563 (dependabot[bot]) • deps-dev: bump browserslist from 4.28.6 to 4.28.8 in /website (#9566) #9566 (dependabot[bot]) • deps: bump the go-deps group with 13 updates (#9578) #9578 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 in /.github/actions/deploy-website in the action-deps group (#9577) #9577 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 in the actions-deps group (#9576) #9576 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 in /.github/actions/e2e/dump-logs in the action-deps group (#9575) #9575 (dependabot[bot]) • deps-dev: bump the website-deps group in /website with 3 updates (#9574) #9574 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 in /.github/actions/e2e/upgrade-crds in the action-deps group (#9572) #9572 (dependabot[bot]) • deps-dev: bump picomatch from 4.0.3 to 4.0.7 in /website (#9579) #9579 (dependabot[bot]) • let a Resolver exclude an instance type without failing List (#9546) #9546 (Andrew Mitchell) • deps: bump the go-deps group with 15 updates (#9594) #9594 (dependabot[bot]) • deps: bump the actions-deps group with 4 updates (#9593) #9593 (dependabot[bot]) • deps-dev: bump the website-deps group in /website with 2 updates (#9592) #9592 (dependabot[bot]) • add stage field to metrics (#9601) #9601 (Ryan Mistretta) • deps: bump the go-deps group with 8 updates (#9615) #9615 (dependabot[bot]) • deps: bump the actions-deps group with 4 updates (#9614) #9614 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 in /.github/actions/deploy-website in the action-deps group (#9613) #9613 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 in /.github/actions/e2e/dump-logs in the action-deps group (#9611) #9611 (dependabot[bot]) • deps: bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 in /.github/actions/e2e/upgrade-crds in the action-deps group (#9610) #9610 (dependabot[bot]) • deps-dev: bump autoprefixer from 10.5.6 to 10.6.1 in /website in the website-deps group (#9612) #9612 (dependabot[bot]) • add 5 minute jitter to ec2nodeclass validation cache TTL (#9624) #9624 (Joshua Guo) • push to PR cancels PRs inflight runs (#9630) #9630 (Ryan Mistretta) • don't report cancelled runs to slack (#9632) #9632 (Ryan Mistretta) • deps: bump the go-deps group with 14 updates (#9639) #9639 (dependabot[bot]) • deps: bump the actions-deps group with 3 updates (#9638) #9638 (dependabot[bot]) • bump sigs.k8s.io/karpenter to f73cdcbf (#9634) #9634 (Derek Frank) • drop karpenter.k8s.aws/nitro-sandbox label (#9642) #9642 (Jason Deal) • remove eks.amazonaws.com/nitro-sandbox resource (#9668) #9668 (Jason Deal) • bump max k8s version to 1.37 (#9684) #9684 (Ryan Mistretta) Commits • 90f724a: split scheduling test suite into two (Sagar Dhana) #9341 • Update label naming for consistency (#9410) #9410 (ahreehong) • 4a562f4: Add memory-manager-reserved-memory to BottlerocketKubernetes settings (#9427) (Tanvir Tatla) #9427
🤖 EKSBot
@eksbot.bsky.social

awslabs/amazon-eks-ami released AMI Release v20261003 #eks #kubernetes

github.comawslabs/amazon-eks-ami released AMI Release v20261003[!IMPORTANT] This release contains kernel 6.12.110 in Amazon Linux 2023 AMIs which might cause kernel panic on certain instances for kubernetes versions 1.31 to 1.35. See https://github.com/awslabs/amazon-eks-ami/issues/2845 What's Changed • fix(nvidia): only start fabric manager on hosts with an NVSwitch fabric by @aaithal in https://github.com/awslabs/amazon-eks-ami/pull/2840 • fix(nvidia): replace /usr overlay mounts with reflink copies so dnf updates survive reboot by @kummatty in https://github.com/awslabs/amazon-eks-ami/pull/2841 New Contributors • @aaithal made their first contribution in https://github.com/awslabs/amazon-eks-ami/pull/2840 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260930...v20261003
🤖 EKSBot
@eksbot.bsky.social

Amazon EKS Auto Mode now supports advanced compute configuration #ec2 #eksautomode #eks #kubernetes

aws.amazon.comAmazon EKS Auto Mode now supports advanced compute configuration<p>Amazon Elastic Kubernetes Service (EKS) Auto Mode now lets you tune kubelet settings, Linux kernel sysctls, and hugepages directly in the NodeClass Kubernetes resource. You can now run workloads that require specific node tuning on EKS Auto Mode, which automates node provisioning, scaling, patching, and upgrades for you.</p> <p>With the new advancedCompute field in NodeClass, you can configure user namespaces for rootless container builds in CI/CD pipelines, tune eviction thresholds and container log rotation to protect nodes from disk and memory pressure, raise network and ARP cache limits for large clusters, and pre-allocate 2Mi or 1Gi hugepages for HPC, database, and latency-sensitive workloads. You apply these settings declaratively using the Kubernetes API. EKS Auto Mode validates them, applies them at node boot, and preserves them through scaling and upgrade events, so your workloads get the tuning they need while EKS Auto Mode continues to manage the underlying infrastructure, with no EC2 launch templates, custom AMIs, or privileged DaemonSets to maintain.</p> <p>Amazon EKS Auto Mode advanced compute configuration is available in all AWS Regions where EKS Auto Mode is available.</p> <p>To get started, see the <a href="https://aws.amazon.com/eks/auto-mode/">Amazon EKS Auto Mode</a> product page, and see <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-node-class.html#kubelet-config">Create a Node Class for Amazon EKS</a> in the Amazon EKS documentation.</p>
🤖 EKSBot
@eksbot.bsky.social

AWS Batch now supports Amazon EKS access entry authentication #eks #kubernetes

aws.amazon.comAWS Batch now supports Amazon EKS access entry authentication<p>AWS Batch now supports Amazon EKS access entry authentication for compute environments. EKS access entries provide an API-driven approach to granting IAM principals access to Kubernetes clusters, complementing the existing <i>aws-auth</i> <i>ConfigMap</i>. AWS Batch can now authenticate to your cluster through the access entry mechanism, simplifying cluster setup and authentication lifecycle management. <br> <br> To get started, use the <i>CreateComputeEnvironment</i> or <i>UpdateComputeEnvironment</i> APIs to set <i>accessEntry.desiredState</i> to ENABLED on all AWS Batch compute environments targeting your cluster. AWS Batch creates one access entry per cluster and associates the <i>AWSBatchClusterPolicy</i> with it. You can configure access entries through the AWS CLI, AWS SDKs, or AWS Management Console. <br> <br> Access entry authentication for AWS Batch on Amazon EKS is now supported in all <a href="https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/">AWS Regions</a> where AWS Batch is available. For more information, see Amazon EKS access entry authentication in the <a href="https://docs.aws.amazon.com/batch/latest/userguide/eks-access-entries.html">AWS Batch User Guide</a>.</p>
🤖 EKSBot
@eksbot.bsky.social

kubernetes-sigs/aws-load-balancer-controller released v3.6.0 #eksautomode #eks #kubernetes

github.comkubernetes-sigs/aws-load-balancer-controller released v3.6.0⚠️ Action Required CRD Updates (Required) There is no Gateway API graduation in this release -- the controller remains built against Gateway API CRDs v1.6.0 (unchanged from v3.5.0). As a safety measure, we recommend applying the latest AWS-vended CRDs before upgrading the controller. Apply the latest AWS-vended CRD definitions: Action : • kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master" • kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml 🚀 What's New Cross-account TargetGroupBinding -- AZ-aware IP registration (opt-in) Cross-account TargetGroupBinding IP targets can now be registered with the pod's actual Availability Zone, improving cross-account zonal routing. Opt-in to preserve existing behavior by default. (#4877, @cqi1217) frontend-nlb-status-only annotation for Ingress New annotation to control whether the Ingress status hostname exposes only the frontend NLB -- fixes ExternalDNS record creation when fronting an ALB Ingress with an NLB. If the NLB is not yet provisioned, no hostname is written. (#4849, @dominikhei) Gateway API customization for downstream/automode importers Importers embedding the controller can now customize Gateway names, customize finalizers, and customize the Gateway controller wiring - enabling consumers to extend Gateway behavior. ReferenceGrant now uses the v1 apiVersion. (#4878, #4886, #4887, @zac-nixon) 🔧 Enhancements and Fixes Gateway • Avoid DuplicateTargetGroupName for Services with multiple named target ports (#4876) • Use v1 for the ReferenceGrant apiVersion; allow finalizers to be customized (#4886) • Use a / separator in Gateway route-loader cache keys to avoid cache-key collisions (#4916) • Fix the deletion guard for Gateway TargetGroupConfigurations still referenced by TCPRoutes (#4802) • Ignore unpermitted cross-namespace TCPRoutes in the Gateway TGC deletion guard, so a TCPRoute without a ReferenceGrant can no longer pin another namespace's TGC finalizer (#4919) **AWS Certificates Management ** • Use the public Route 53 zone for Amazon-issued ACM DNS validation in split-horizon DNS setups (#4847) Networking / TargetGroupBinding • Canonicalize CIDRs for security-group inbound rules to avoid spurious reconciliation failures (#4904) • Fix TargetGroupBinding networking with empty ports (#4909) WAF • Ignore a WAF ACL set to an empty string (treat as unset) (#4888) Controller / Informer robustness • Handle DeletedFinalStateUnknown tombstones in TypedInformer's DeleteFunc (#4879) • Make the pod informer transform idempotent so WatchList streaming sync no longer falls back to a full LIST (#4881) Misc • Clearer OIDC permission messaging (#4912) 📖 Documentation Updates • Warn against manually deleting controller-generated TargetGroupBinding objects (#4902) • Document security/trust implications of AllowedRoutes.Namespaces.From: All (#4872) • Remove unsupported vpcId field from LoadBalancerConfiguration docs (#4760) • Fix wrong default for frontend-nlb-eip-allocations in annotation docs (#4871) • Fix ipam-ipv4-pool-id example plus tip/note block spacing (#4752) What's Changed • Document security/trust implications of AllowedRoutes.Namespaces.From… by @wweiwei-li in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4872 • docs: Remove vpcId from LoadBalancerConfiguration documentation by @dominikhei in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4760 • fix(gateway): avoid DuplicateTargetGroupName for Services with multiple named targetPorts by @legal90 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4876 • fix: ipam-ipv4-pool-id example, tip and note block spacing by @wind0r in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4752 • feat(gateway custom): allow importers to customize gateway names by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4878 • fix: handle DeletedFinalStateUnknown tombstones in TypedInformer's DeleteFunc by @ginbear in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4879 • Make pod informer transform idempotent so WatchList streaming sync does not fall back to full LIST by @yash97 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4881 • use v1 for referencegrant apiversion, allow finalizers to be customized for gateway api by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4886 • refactor: Allow automode controllers to customize the gateway controller by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4887 • fix(waf): ignore waf acl set to empty string by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4888 • refactor: making tests configurable to run on eks auto framework by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4891 • test: mirror UDP/GRPC test images to networking-e2e-test-images by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4894 • test/gateway: make e2e suite partition-aware and register ECR tag resolver by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4908 • chore: OIDC permission messaging by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4912 • fix: canonicalize CIDRs for security group inbound rules to avoid reconciliation failures by @bobert-2 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4904 • test: default GRPC/UDP images to public ECR to fix the tests by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4911 • Fix TGB networking with empty ports by @dlanov in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4909 • docs: warn against manually deleting controller-generated TargetGroupBinding by @shashankvarma499 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4902 • Register cross-account TargetGroupBinding IP targets with the pod's availability zone (opt-in) by @cqi1217 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4877 • Fixed wrong default for frontend-nlb-eip-allocations in annotation docs by @dominikhei in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4871 • Added frontend-nlb-status-only annotation to fix ExternalDNS record creation when using a frontend NLB by @dominikhei in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4849 • fix: use '/' separator in Gateway route-loader cache keys to avoid co… by @wweiwei-li in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4916 • fix: use public Route 53 zone for Amazon-issued ACM DNS validation in split-horizon DNS by @niv1612 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4847 • Fix deletion guard for Gateway TargetGroupConfigurations still referenced by TCPRoutes by @immanuwell in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4802 • fix: ignore unpermitted cross namespace TCPRoutes in gateway target TGC deletion guard by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4919 • cut v3.6.0 release by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4921 New Contributors • @dominikhei made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4760 • @legal90 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4876 • @wind0r made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4752 • @ginbear made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4879 • @yash97 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4881 • @dlanov made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4909 • @shashankvarma499 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4902 • @cqi1217 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4877 • @niv1612 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4847 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.5.0...v3.6.0
🤖 EKSBot
@eksbot.bsky.social

Amazon EKS and Amazon EKS Distro now support Kubernetes version 1.37 #eks #kubernetes

aws.amazon.comAmazon EKS and Amazon EKS Distro now support Kubernetes version 1.37<p>Kubernetes version 1.37 introduced several new features and bug fixes, and AWS is excited to announce that you can now use <a href="https://aws.amazon.com/eks/" target="_blank" rel="noopener noreferrer">Amazon Elastic Kubernetes Service</a> (EKS) and <a href="https://aws.amazon.com/eks/eks-distro/" target="_blank" rel="noopener noreferrer">Amazon EKS Distro</a> to run Kubernetes version 1.37. Starting today, you can create new EKS clusters using version 1.37 and upgrade existing clusters to version 1.37 using the EKS console, the eksctl command line interface, or through an infrastructure-as-code tool.</p> <p>Kubernetes version 1.37 introduces several key improvements, promoting the Metrics API to general availability as <i>metrics.k8s.io/v1</i>. This API provides Pod and node CPU and memory usage for the Horizontal Pod Autoscaler and <i>kubectl top</i>. Dynamic Resource Allocation (DRA) device taints and tolerations also graduate to general availability, letting DRA drivers and administrators taint devices such as GPUs so the scheduler avoids them unless tolerated. Horizontal Pod Autoscaler scale-to-zero graduates to beta and is enabled by default, allowing autoscalers with <i>minReplicas: 0</i> that use object or external metrics to scale workloads to zero Pods when idle and back up when demand returns. To learn more about Kubernetes version 1.37, see our <a href="https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions-standard.html" target="_blank" rel="noopener noreferrer">documentation</a> and the Kubernetes project <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md" target="_blank" rel="noopener noreferrer">release notes.</a></p> <p>EKS now supports Kubernetes version 1.37 in all the AWS Regions where EKS is available, including the AWS GovCloud (US) Regions.</p> <p>You can learn more about the Kubernetes versions available on EKS and instructions to update your cluster to version 1.37 by visiting EKS documentation. You can use <a href="https://docs.aws.amazon.com/eks/latest/userguide/cluster-insights.html" target="_blank" rel="noopener noreferrer">EKS cluster insights</a> to check if there are any issues that can impact your Kubernetes cluster upgrades. EKS Distro builds of Kubernetes version 1.37 are available through ECR Public Gallery and GitHub. Learn more about the EKS version lifecycle policies in the <a href="https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html" target="_blank" rel="noopener noreferrer">documentation</a>.</p>
🤖 EKSBot
@eksbot.bsky.social

awslabs/amazon-eks-ami released AMI Release v20260930 #eks #kubernetes

github.comawslabs/amazon-eks-ami released AMI Release v20260930What's Changed • feat: added skip_profile_validation variable by @Youssef-Beltagy in https://github.com/awslabs/amazon-eks-ami/pull/2831 • revert: don't try to prefetch nodeadm by @fletcherw in https://github.com/awslabs/amazon-eks-ami/pull/2832 • feat(log-collector,linux): collect pstore by @mselim00 in https://github.com/awslabs/amazon-eks-ami/pull/2836 • fix(nvidia): rebuild ld.so.cache at boot for legacy container injection by @kummatty in https://github.com/awslabs/amazon-eks-ami/pull/2835 • fix(nodeadm): migrate cel-go to cel.dev/cel-go and update dependencies by @shvbsle in https://github.com/awslabs/amazon-eks-ami/pull/2838 New Contributors • @arsbw2802 made their first contribution in https://github.com/awslabs/amazon-eks-ami/pull/2830 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260923...v20260930
🤖 EKSBot
@eksbot.bsky.social

AI-powered EKS migration assessment with Amazon Bedrock AgentCore #eks #kubernetes

aws.amazon.comAI-powered EKS migration assessment with Amazon Bedrock AgentCoreLearn how to build an AI-powered migration assessment agent using Amazon Bedrock AgentCore and the Strands Agents SDK. The agent reads application source code and container artifacts, scores Amazon EKS migration readiness, identifies blockers by severity, and generates an actionable migration plan with target architecture recommendations.
🤖 EKSBot
@eksbot.bsky.social

How athenahealth modernized healthcare workloads with Amazon EKS Hybrid Nodes #eks #kubernetes

aws.amazon.comHow athenahealth modernized healthcare workloads with Amazon EKS Hybrid NodesLearn how athenahealth used Amazon EKS Hybrid Nodes to modernize latency-sensitive healthcare workloads on premises, cutting response times in half, reducing hardware and operational costs by 50%, and maintaining a single Kubernetes operating model across its data center and the cloud while meeting HITRUST and data residency requirements.
🤖 EKSBot
@eksbot.bsky.social

Fix pod distribution drift in Amazon EKS with the Kubernetes descheduler #eks #kubernetes

aws.amazon.comFix pod distribution drift in Amazon EKS with the Kubernetes deschedulerA workload spread across three Availability Zones does not necessarily stay spread. This post explains why soft topology spread constraints drift after a node-availability gap, measures the cost, and shows how the Kubernetes descheduler restores even pod distribution on Amazon EKS without downtime and without forcing hard constraints.
🤖 EKSBot
@eksbot.bsky.social

awslabs/amazon-eks-ami released AMI Release v20260923 #eks #kubernetes

github.comawslabs/amazon-eks-ami released AMI Release v20260923What's Changed • fix(boot-hook): poll managed interfaces from netmanager cache by @mselim00 in https://github.com/awslabs/amazon-eks-ami/pull/2821 • feat: use igzip for decompression by @fletcherw in https://github.com/awslabs/amazon-eks-ami/pull/2828 • chore(nodeadm): bump gover to 1.26.8 by @mselim00 in https://github.com/awslabs/amazon-eks-ami/pull/2829 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260917...v20260923
🤖 EKSBot
@eksbot.bsky.social

One Amazon EKS, many edges: How to choose your edge container strategy on AWS #eks #kubernetes

aws.amazon.comOne Amazon EKS, many edges: How to choose your edge container strategy on AWSChoosing the right edge container strategy across many locations can fragment your fleet into dozens of special cases. This post shows how to avoid that by standardizing on Amazon EKS, then choosing a deployment model per site: gate on connectivity, then match to existing infrastructure, so every edge runs the same Kubernetes standard.
🤖 EKSBot
@eksbot.bsky.social

Run interactive workloads on Amazon EMR on EKS with Spark Connect #eks #kubernetes

aws.amazon.comRun interactive workloads on Amazon EMR on EKS with Spark Connect<p>Amazon EMR on EKS now supports interactive Apache Spark sessions with Spark Connect. Data engineers and data scientists can develop and debug Apache Spark applications interactively from managed notebooks in Amazon SageMaker Unified Studio and their own IDEs, such as Jupyter and Visual Studio Code, with Spark running on the Amazon EKS clusters they already operate. &nbsp;</p> <p>An interactive session provides a persistent Spark context that spans across cells and scripts, letting you blend local Python code execution with remote Spark operations. Spark Connect's client-server architecture decouples your application client from the Spark driver and allows you to maintain your preferred development environment and tooling while Spark runs on your Amazon EKS cluster. This architecture supports workflows including ad hoc data exploration and incremental PySpark job development before deploying to production. Each session runs as pods on a virtual cluster, secured with your AWS Identity and Access Management (IAM) execution role and tagged by project and user.</p> <p>Spark Connect on Amazon EMR on EKS is available with EMR release 7.14 (Apache Spark 3.5) and emr-spark-8.1.0 (Apache Spark 4.1), in all AWS Commercial Regions. The Amazon SageMaker Unified Studio experience is available in <a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/supported-regions.html">supported AWS Regions</a>.</p> <p>To get started, visit the <a href="https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-spark-connect.html">Spark Connect on Amazon EMR on EKS documentation</a> or the <a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/notebooks-spark-connect.html#spark-connect-emr-eks">Amazon SageMaker Unified Studio Getting Started guide.</a></p>
🤖 EKSBot
@eksbot.bsky.social

Amazon EMR on EKS now supports IPv6 Amazon EKS clusters #eks #kubernetes

aws.amazon.comAmazon EMR on EKS now supports IPv6 Amazon EKS clusters<p>Today, AWS announces that Amazon EMR on EKS now supports running workloads on IPv6 Amazon Elastic Kubernetes Service (Amazon EKS) clusters. Amazon EMR on EKS enables data platform and analytics teams to run open-source big data frameworks such as Apache Spark and Apache Flink on Amazon EKS. With IPv6 support, teams operating at scale can now run these workloads on IPv6 Amazon EKS clusters, giving them access to the vastly larger address space of IPv6 as their analytics workloads grow.</p> <p>You can now scale large Spark and Flink workloads using the expanded IPv6 address space, which removes the need for IPv4 conservation workarounds such as secondary CIDR ranges or prefix delegation. High-executor jobs, such as 500-executor Spark jobs, can run concurrently without planning around address limits. To submit workloads, use StartJobRun, Spark Connect Interactive Endpoints, and Amazon SageMaker Unified Studio with no additional configuration, while the Flink, Livy, and Spark Operators are also supported. This capability is available at no additional cost, starting with Amazon EMR releases emr-7.14.0 and emr-spark-8.0.0.</p> <p>IPv6 cluster support is available in all AWS Regions where Amazon EMR on EKS and IPv6 Amazon EKS clusters are available.</p> <p>Amazon EMR on EKS IPv6 cluster support includes detailed setup instructions and documentation on supported submission models. Visit the <a href="https://aws.amazon.com/emr/features/eks/">Amazon EMR on EKS product page</a> and the <a href="https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-ipv6.html">IPv6 documentation</a> to learn more.&nbsp;</p>
🤖 EKSBot
@eksbot.bsky.social

awslabs/amazon-eks-ami released AMI Release v20260917 #eks #kubernetes

github.comawslabs/amazon-eks-ami released AMI Release v20260917Highlights NVIDIA driver installation has been reworked (#2819). The NVIDIA accelerated AL2023 AMIs now bakes two driver versions; R580 and R595, into the image as pre-built driver trees. On first boot a node inspects its attached GPUs and instance type, then activates the driver version and flavor (open, proprietary, or grid) that its hardware needs. If you encounter unexpected behavior on your GPU nodes, please open an issue or an AWS Support Case. What's Changed • feat(nvidia): bake lts and pb driver trees, resolve one at boot by @kummatty in https://github.com/awslabs/amazon-eks-ami/pull/2819 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260911...v20260917
🤖 EKSBot
@eksbot.bsky.social

ReadyOn’s Four Walls of tenant isolation on Amazon EKS #karpenter #eks #kubernetes

aws.amazon.comReadyOn’s Four Walls of tenant isolation on Amazon EKSReadyOn runs a multi-tenant platform on Amazon EKS that handles highly sensitive enterprise data. This post describes their Four Walls model: four independent layers of tenant isolation combining Kubernetes namespaces, Karpenter node pools, Amazon VPC security groups, and per-tenant Amazon Aurora databases for zero-trust defense in depth.
🤖 EKSBot
@eksbot.bsky.social

How Equinix cut operational overhead with a shared services architecture on Amazon EKS #eks #kubernetes

aws.amazon.comHow Equinix cut operational overhead with a shared services architecture on Amazon EKSEquinix, the world's digital infrastructure company, built a shared services architecture on Amazon EKS to eliminate the operational sprawl of its self-managed Kubernetes environment. Learn how a multi-account North Star architecture centralized governance and shared services, delivering 4x faster deployments and 40% less operational overhead.
🤖 EKSBot
@eksbot.bsky.social

AWS Private CA EKS add-on and Connector for AD now available in AWS GovCloud (US) #eks #kubernetes

aws.amazon.comAWS Private CA EKS add-on and Connector for AD now available in AWS GovCloud (US)<p>AWS Private Certificate Authority (AWS Private CA) announces the availability of the AWS Private CA Connector for Kubernetes as a managed Amazon EKS add-on and the AWS Private CA Connector for Active Directory in AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. These launches expand certificate automation capabilities available to AWS GovCloud (US) customers managing government workloads.</p> <p>The AWS Private CA Connector for Kubernetes EKS add-on provides simplified installation, configuration, and lifecycle management through the EKS console, CLI, and API. The connector works with cert-manager to automate certificate requests, distribution to Kubernetes secrets, and renewal, enabling TLS for ingress controllers and securing service-to-service communication in service meshes such as Istio and Linkerd.</p> <p>The AWS Private CA Connector for Active Directory enables AWS GovCloud (US) customers to use AWS Private CA as their certificate authority for Active Directory-enrolled objects. The connector provides automatic certificate issuance to domain-joined users, computers, and other objects through familiar Microsoft certificate enrollment interfaces, supporting enterprise scenarios including smart card authentication, LDAPS, and network device authentication (802.1x).</p> <p>AWS Private CA secures private key material using FIPS 140-3 Level 3 hardware security modules (HSMs).</p> <p>To get started, see the <a href="https://aws.amazon.com/private-ca/">AWS Private CA product page</a>, the <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html">Amazon EKS add-ons user guide</a>, and the <a href="https://docs.aws.amazon.com/privateca/latest/userguide/connector-for-ad.html">AWS Private CA Connector for Active Directory documentation</a>.</p>
🤖 EKSBot
@eksbot.bsky.social

awslabs/kro released v0.9.4 #kro #eks #kubernetes

github.comawslabs/kro released v0.9.4What's Changed • Use stdlib maps and slices instead of x/exp by @v47 in https://github.com/kubernetes-sigs/kro/pull/1345 • fix(graph): key extended CEL env cache by schema, not just var name by @pujitha24 in https://github.com/kubernetes-sigs/kro/pull/1340 • fix(helm): repair chart template gaps found during review by @armanfeyzi in https://github.com/kubernetes-sigs/kro/pull/1307 • feat(chart): add user role aggregation to view, edit and admin ClusterRole by @reshnm in https://github.com/kubernetes-sigs/kro/pull/1342 • fix(instance): set ResourcesReady=False with ReconciliationSuspended reason when suspended by @RohanKaran in https://github.com/kubernetes-sigs/kro/pull/1282 • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /tools/lsp/server in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1336 • chore(deps): bump golang.org/x/net from 0.47.0 to 0.55.0 in the go-security-updates group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1335 • fix(cel): prevent panic when uint/bytes CEL values reach deep-copy by @pujitha24 in https://github.com/kubernetes-sigs/kro/pull/1346 • feat: add shortNames and categories in the RGD by @fabianburth in https://github.com/kubernetes-sigs/kro/pull/1347 • helm: add extraEnv support to deployment template by @n3rdc4ptn in https://github.com/kubernetes-sigs/kro/pull/1349 • feat(cel): add deepMerge() for recursive nested map merging by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1348 • fix: Support ordered deletion without desired-state projection, CEL evaluation, GraphRevision resolution or external observation by @tomasaschan in https://github.com/kubernetes-sigs/kro/pull/1318 • fix(logging): route klog to zap and make zap-devel configurable in Helm by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1352 • test: raise coverage on pkg/cel/library and pkg/graph/crd/compat by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1357 • chore(deps): bump all project dependencies by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1356 • chore(deps): enable Dependabot version updates and widen module coverage by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1358 • chore(deps): bump actions/setup-node from 5.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1359 • chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1361 • chore(deps): bump actions/checkout from 5.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1360 • chore(deps): bump the npm-security-updates group across 1 directory with 6 updates by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1363 • refactor: scaffolding for graph development work; incremental from #1355 by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1365 • fix(simpleschema): sort synthesized CRD required fields for deterministic output by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1366 • chore(deps): bump @babel/core from 7.28.4 to 7.29.7 in /website in the npm-security-updates group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1364 • lint: bump golangci-lint to v2.12.2 and update lint configuration by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1368 • refactor(watch): extract shared informer-fleet Manager into pkg/watch by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1370 • test: unify integration test suites under a single shared control plane by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1371 • docs: note that lists built from maps need sort() for stable ordering by @allamand in https://github.com/kubernetes-sigs/kro/pull/1375 • fix(crd): detect additionalPrinterColumns changes when updating CRDs by @pujitha24 in https://github.com/kubernetes-sigs/kro/pull/1378 • chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.0 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1383 • fix(helm): honor service account automount setting by @immanuwell in https://github.com/kubernetes-sigs/kro/pull/1380 • chore(deps-dev): bump @types/vscode from 1.125.0 to 1.134.0 in /tools/lsp/client in the npm-version-updates group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1381 • chore(deps): bump softprops/action-gh-release from 2.4.1 to 3.0.2 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1382 • chore: update e2e test for termination and fix ALLOW_CRD_DELETION correctly by @Skarlso in https://github.com/kubernetes-sigs/kro/pull/1384 • chore(deps): bump the npm-version-updates group across 2 directories with 6 updates by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1387 • chore(deps): bump Go modules, npm packages and GitHub Actions by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1389 • Enable full CEL expressions support for external collection selectors by @tbarizien in https://github.com/kubernetes-sigs/kro/pull/1230 • Bump kro version to 0.9.4 with docs cut by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1394 New Contributors • @v47 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1345 • @pujitha24 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1340 • @armanfeyzi made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1307 • @reshnm made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1342 • @RohanKaran made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1282 • @n3rdc4ptn made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1349 • @immanuwell made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1380 • @Skarlso made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1384 • @tbarizien made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1230 Full Changelog: https://github.com/kubernetes-sigs/kro/compare/v0.9.3...v0.9.4