Amazon EKS now supports advanced Kubernetes control plane configuration parameters

<p><a href="https://aws.amazon.com/pm/eks/" target="_blank" rel="noopener noreferrer">Amazon Elastic Kubernetes Service (Amazon EKS)</a> now supports configuring parameters for Kubernetes control plane components including the scheduler, controller manager, and API server. You can tune pod placement strategies to improve resource utilization, adjust how quickly horizontal pod autoscaling responds to changes in demand, set resource lifecycle parameters such as event retention duration, and more.<br> <br> Cluster administrators now have more control over Kubernetes control plane parameters beyond the defaults. For example, you can set the scheduler's node resource fit strategy parameter to <i>MostAllocated</i>, which packs pods onto nodes that are already well utilized and helps you run the same workloads on fewer nodes. The default <i>LeastAllocated</i> strategy spreads pods across nodes, and you can keep it where headroom matters more than density.<br> <br> You can configure Kubernetes control plane parameters in any AWS Region where Amazon EKS is available. For the full list of configurable parameters and to learn more, see Control plane configuration in the <a href="https://docs.aws.amazon.com/eks/latest/userguide/control-plane-configuration.html" target="_blank" rel="noopener noreferrer">Amazon EKS User Guide</a>.</p>

aws.amazon.com

Forensic container checkpointing on Amazon Elastic Kubernetes Service (Amazon EKS)

Amazon EKS 1.34 makes the Kubelet Checkpoint API functional, so you can capture a running container's full state (memory, processes, and network connections) without stopping the workload. This post shows how to deploy an unprivileged checkpoint agent that stores forensic checkpoints in Amazon ECR as OCI images for later analysis.

aws.amazon.com

Introducing advanced Kubernetes control plane configuration in Amazon EKS

With Amazon EKS, you can now configure Kubernetes control plane components (the API server, scheduler, and controller manager) directly through EKS APIs. This post explains what's configurable and includes two hands-on walkthroughs: enabling MostAllocated bin-packing to optimize pod placement, and tuning event retention duration.

aws.amazon.com

Under the hood: how Amazon EKS Auto Mode detects, repairs, and diagnoses node failures

On Amazon EKS Auto Mode, node failures are detected, drained, and replaced automatically before anyone reaches for a laptop. This post shows how the Node Monitoring Agent and Karpenter form a detect-and-replace cycle that runs by default, why specific faults trigger node replacement, and how to collect node diagnostics without SSH.

aws.amazon.com

awslabs/amazon-eks-ami released AMI Release v20260801

What's Changed • feat(nodeadm): add more variables to maxPodsExpression by @joshuakguo in https://github.com/awslabs/amazon-eks-ami/pull/2777 • feat: add multi-EBS volume storage support for AL2023 nodes by @maitreya526 in https://github.com/awslabs/amazon-eks-ami/pull/2759 New Contributors • @joshuakguo made their first contribution in https://github.com/awslabs/amazon-eks-ami/pull/2777 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260728...v20260801

github.com

kubernetes-sigs/aws-load-balancer-controller released v3.5.0

Documentation Thanks to all our contributors!💜💜💜 ⚠️ Action Required Gateway API CRD Updates (All Gateway API users) Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller. Why: This release requires Gateway API CRDs v1.6.0. The controller is built against this version for conformance and feature support Important: Update CRDs before upgrading the controller. If you upgrade the controller first, NLB Gateway (TCPRoute/UDPRoute/TLSRoute) will be automatically disabled until the CRDs are updated. Since the standard install no longer serves v1alpha2, you must update any existing v1alpha2 route manifests to gateway.networking.k8s.io/v1 Action: Apply v1.6 Gateway CRDs kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml LBC Gateway CRD Updates (All Gateway API users) Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller. Why: This release adds v1 as the storage version for LBC-specific Gateway CRDs (LoadBalancerConfiguration, TargetGroupConfiguration, ListenerRuleConfiguration), with v1beta1 marked as deprecated. The controller reads v1 only, but existing v1beta1 resources are transparently converted to v1 by the API server — no immediate manifest changes required. However, v1beta1 will stop being served in a future release. We recommend updating your manifests to use gateway.k8s.aws/v1 at your earliest convenience. Action: Apply the updated LBC Gateway CRDs: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml 🚀What's New Gateway API v1 Graduation This release graduates Gateway API support to v1 for L4 routes. TCPRoute and UDPRoute now use the stable gateway.networking.k8s.io/v1 API version (previously v1alpha2), and the controller passes Gateway API conformance v1.6.0. The AWS-vended Gateway API CRDs have been upgraded to v1 accordingly. 🔧Enhancements and Fixes Certificate Management • Fix ACM certificate creation for Ingresses with wildcard hosts — the character in hostname was breaking ACM tag validation Certificate list support for ECDSA/RSA use • Add certificate management controller flag to helm chart Route Precedence • Unified cross-kind route precedence for HTTPRoute/GRPCRoute, single code path eliminates non-transitivity • Fix non-transitive rule precedence for routes without hostnames Networking • Filter EndpointSlices by IP family for target group registration • Match hosted zones by longest suffix in GetHostedZoneID • Fix: ICMP Type/Code constants • Fix: render feature gates as parseable key-value pairs Module & Build • Module path updated to sigs.k8s.io/aws-load-balancer-controller/v3. Users who are importing the code base will need to adjust their imports accordingly. Helm • Correct enableEndpointSlices default in Helm values comment 📖 Documentation Updates • Add guidance on migrating between services without downtime • Clarify scheme change replacement behavior • Fix Markdown formatting of blue/green guide • Fix stale contributor setup and invalid IAM role ARN examples • Fix doc annotation name • Fix admonition indentation for ipam-ipv4-pool-id annotation • Clarify WAF addon ownership and document IngressGroup security risks • Remove CloudFormation link What's Changed • Fix Markdown formatting of blue/green guide by @Tenzer in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4835 • ci: Add GO-2026-5932 to govulncheck ignore list by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4839 • use /v3 in module name by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4770 • feat(gateway): Use Gateway API v1 for TCPRoute and UDPRoute by @nicomazzarello in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4829 • upgrade AWS vended Gateway API CRDs to v1 by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4844 • update code to use v1 crds by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4845 • Add label for accessing secrets - to support restricted access for EKS Auto LBC by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4838 • docs: fix admonition indentation for ipam-ipv4-pool-id annotation by @nikhilmaheshwari24 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4837 • v1.6.0 conformance + rule refactor by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4861 • fix: handle invalid condition name for tgb by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4862 • Fix ACM certificate creation for Ingresses with wildcard hosts by @nbr in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4786 • docs: clarify scheme change replacement by @kappa8219 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4860 • fix: use "/" separator in getCacheKey to avoid TGB cache collisions by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4864 • fix: subnet auto-discovery to IPv6-capable subnets for dualstack ip address type by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4865 • Add ipv6 check for tests by @wweiwei-li in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4868 • cut v3.5.0 release by @wweiwei-li in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4869 New Contributors • @Tenzer made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4835 • @nicomazzarello made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4829 • @nikhilmaheshwari24 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4837 • @kappa8219 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4860 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.4.2...v3.5.0

github.com

awslabs/amazon-eks-ami released AMI Release v20260728

Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260724...v20260728

github.com

kubernetes-sigs/aws-load-balancer-controller released v3.4.3

Documentation Thanks to all our contributors!💜💜💜 ⚠️ Action Required Double check your ALB rule limits, when using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated. Users who specify multiple hostnames per route will want to double check their ALB limits. https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4863/changes/2c657342ff09998a92fddf1fbcb945ecc7ef612a CRD Updates • No CRD updates required for this release. IAM Policy Updates • No IAM policy changes required for this release. Gateway API updates • No Gateway API CRD updates required for this release. 🔧 Enhancements and Fixes [Rule precedence] - When using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated. [Validation Fix] - Fixed a bug that let invalid protocol types get ignored, rather than throwing a validation error. [Process Crash] - Fixed a bug that caused a NPE when an invalid pod health condition was present. What's Changed • V3.4.3 by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4863 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.4.2...v3.4.3

github.com

Amazon EKS now supports AWS PrivateLink for the cluster OIDC endpoint

<p><a href="https://aws.amazon.com/eks/" target="_blank" rel="noopener noreferrer">Amazon Elastic Kubernetes Service</a> (Amazon EKS) now supports <a href="https://docs.aws.amazon.com/eks/latest/userguide/vpc-interface-endpoints.html#oidc-vpc-interface-endpoints" target="_blank" rel="noopener noreferrer">AWS PrivateLink for the cluster OIDC discovery and JWKS endpoint</a>. You can now reach the endpoint used by <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" target="_blank" rel="noopener noreferrer">IAM roles for service accounts (IRSA)</a> privately from your VPC without requiring internet egress.<br> <br> Each EKS cluster publishes public signing keys at its OIDC endpoint for IRSA. With AWS PrivateLink for the cluster OIDC endpoint, tools running inside your VPC, such as eksctl, Terraform, or custom token validators, can now reach the OIDC discovery document and JWKS privately by creating an interface VPC endpoint for the com.amazonaws.&lt;region&gt;.oidc-eks service. This enables IRSA setup and token validation in VPCs without internet egress and ensures correct DNS resolution when the EKS management VPC endpoint is enabled with private DNS.<br> <br> AWS PrivateLink for the cluster OIDC endpoint is available at no additional cost beyond standard <a href="https://aws.amazon.com/privatelink/pricing/" target="_blank" rel="noopener noreferrer">AWS PrivateLink pricing</a> in all AWS Regions where Amazon EKS is available. To get started, see <a href="https://docs.aws.amazon.com/eks/latest/userguide/vpc-interface-endpoints.html#oidc-vpc-interface-endpoints" target="_blank" rel="noopener noreferrer">Access the cluster OIDC endpoint using AWS PrivateLink</a> in the Amazon EKS User Guide.</p>

aws.amazon.com

Amazon EKS Provisioned Control Plane now delivers faster pod autoscaling

<p><a href="https://aws.amazon.com/pm/eks">Amazon EKS</a> now delivers faster pod autoscaling across all <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-provisioned-control-plane.html">Provisioned Control Plane</a> clusters by increasing <a href="https://kubernetes.io/docs/concepts/workloads/autoscaling/horizontal-pod-autoscale/">Horizontal Pod Autoscaler (HPA)</a> sync concurrency to up to 40 times the default Kubernetes value. This reduces the time it takes for HPA-driven workloads to scale in response to increased load, enabling faster responsiveness to demand.<br> <br> The Kubernetes Horizontal Pod Autoscaler (HPA) continuously monitors workload metrics and adjusts pod counts to match demand. In clusters running hundreds or thousands of HPA objects, the speed at which the Kubernetes control plane processes these objects determines how quickly workloads scale in response to changing demand. The HPA sync concurrency setting controls how many HPA objects the control plane evaluates in parallel. By increasing this value, Provisioned Control Plane clusters now process more HPA objects simultaneously, reducing the time between detecting increased load and scaling out pods.<br> <br> This enhancement is available to all customers using EKS Provisioned Control Plane and requires no configuration changes. To learn more about this enhancement, see EKS Provisioned Control Plane in the EKS <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-provisioned-control-plane.html">User Guide</a>.</p>

aws.amazon.com

kubernetes-sigs/aws-ebs-csi-driver released v1.63.1

AWS EBS CSI Driver CHANGELOG See CHANGELOG for full list of changes

github.com

kubernetes-sigs/aws-ebs-csi-driver released helm-chart-aws-ebs-csi-driver-2.63.1

A Helm chart for AWS EBS CSI Driver

github.com

awslabs/kro released v0.9.3

What's Changed • cut docs v0.9.2 by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1281 • Bump upload-pages-artifact to v5 to fix SHA pinning violation by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1285 • chore(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 in /cmd/kro in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1272 • Update gcb-docker-gcloud builder image to fix push-images job by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1286 • Reapply "Emit instance condition telemetry" by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1287 • update zoom link for community meeting by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1291 • Fix nil pointer dereference in ExternalDocs conversion by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1299 • fix: instance deletion stuck when SSA field manager owns finalizer by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1260 • fix: recover panics in dynamic controller instance reconcile by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1311 • pkg/graph: expose options for NewBuilder() by @neolit123 in https://github.com/kubernetes-sigs/kro/pull/1305 • fix(cel): accept whole-valued float64 for integer-typed schema fields by @RanMarkovich in https://github.com/kubernetes-sigs/kro/pull/1304 • chore: bump go.opentelemetry.io/otel to v1.44.0 to patch CVE by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1312 • Update 02-conditional-creation.md by @deogratias-saidi in https://github.com/kubernetes-sigs/kro/pull/1306 • Update KRO version to 0.9.2 in docs by @jehof in https://github.com/kubernetes-sigs/kro/pull/1297 • Fix RGD CRD description examples to match parser behavior by @iammerus in https://github.com/kubernetes-sigs/kro/pull/1321 • Add author-defined custom status conditions to RGD instances by @lalitg327 in https://github.com/kubernetes-sigs/kro/pull/1301 • fix: build package paths instead of single files in Makefile and CI by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1323 • docs(website): fix broken relative links in overview and resource-basics by @numb86 in https://github.com/kubernetes-sigs/kro/pull/1315 • Update condition telemetry to reflect author conditions by @lalitg327 in https://github.com/kubernetes-sigs/kro/pull/1325 • docs: Helm does not update CRDs when upgrading to latest by @johanngoltz in https://github.com/kubernetes-sigs/kro/pull/1326 • chore(deps): bump the go_modules group across 2 directories with 1 update by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1320 • Compute condition duration metric at scrape time via a Collector by @lalitg327 in https://github.com/kubernetes-sigs/kro/pull/1329 • Fix custom conditions status flow and tighten build-time validation by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1331 • KREP-024: Graph — atomic composition primitive by @ellistarn in https://github.com/kubernetes-sigs/kro/pull/1302 • feat(graph): allow schema.* references in instance status expressions by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1300 • cut docs v0.9.3 by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1333 • set KRO version to 0.9.3 by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1334 New Contributors • @cheeseandcereal made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1311 • @neolit123 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1305 • @RanMarkovich made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1304 • @deogratias-saidi made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1306 • @jehof made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1297 • @iammerus made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1321 • @lalitg327 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1301 • @numb86 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1315 • @johanngoltz made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1326 Full Changelog: https://github.com/kubernetes-sigs/kro/compare/v0.9.2...v0.9.3

github.com

awslabs/amazon-eks-ami released AMI Release v20260724

Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260714...v20260724

github.com

ARC zonal shift support for EKS Auto Mode and Karpenter

In this post, we walk through how zonal shift integrates with Amazon Elastic Kubernetes Service (Amazon EKS) and what happens when a shift is triggered. We also show how to enable it on both self-managed Karpenter and EKS Auto Mode (EKS Auto) clusters.

aws.amazon.com

kubernetes-sigs/aws-ebs-csi-driver released v1.63.0

AWS EBS CSI Driver CHANGELOG See CHANGELOG for full list of changes

github.com

kubernetes-sigs/aws-ebs-csi-driver released helm-chart-aws-ebs-csi-driver-2.63.0

A Helm chart for AWS EBS CSI Driver

github.com

Amazon EKS now supports EFA and placement groups on Amazon EKS Auto Mode and Karpenter

<p>Amazon Elastic Kubernetes Service (EKS) now supports Amazon EC2 placement groups and Elastic Fabric Adapter (EFA) network device configuration for node pools on EKS Auto Mode and the open-source Karpenter project, enabling you to optimize EKS workloads for performance and availability. These capabilities allow you to control EFA network interface configuration and how EC2 instances are physically distributed across AWS infrastructure for distributed training and inference workloads.<br> <br> With EKS Auto Mode and Karpenter’s EFA configuration, you can configure network interfaces as EFA-only or standard ENI on EFA-capable instances with both dynamic and static capacity node pools. EFA-only interfaces do not consume IP addresses, giving you fine-grained control over IP utilization in your VPC while achieving full interconnect bandwidth. With placement group support, you can launch EC2 instances using cluster, spread, or partition strategies directly from your EKS Auto Mode or Karpenter node pool configuration, giving you control over how instances are physically distributed without additional operational workarounds. Together, these capabilities let you optimize for the performance, availability, and fault isolation characteristics your workloads require, whether that's maximizing throughput for distributed training jobs or minimizing blast radius for critical production services.<br> <br> These features are available in all AWS Regions where Amazon EKS is available. To get started and learn more, see the <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-node-class.html#static-network-interfaces">EKS Auto Mode User Guide</a> and <a href="https://karpenter.sh/docs/concepts/nodeclasses/#specnetworkinterfaces">Karpenter documentation</a>.</p>

aws.amazon.com

awslabs/amazon-eks-ami released AMI Release v20260714

What's Changed • fix: pin python3 to pre-CVE version to fix moto pkgutil crash in e2e tests by @maitreya526 in https://github.com/awslabs/amazon-eks-ami/pull/2760 • Revert "Pin AL2023 source AMI to 2023.12.20260611.0 (#2757)" by @shvbsle in https://github.com/awslabs/amazon-eks-ami/pull/2766 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260709...v20260714

github.com

aws/karpenter-provider-aws released v1.1.10

Chores • bump sigs.k8s.io/karpenter to v1.1.5 (#9405) #9405 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.2.8

Chores • bump sigs.k8s.io/karpenter to v1.2.5 (#9404) #9404 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.3.8

Chores • bump sigs.k8s.io/karpenter to v1.3.5 (#9403) #9403 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.4.4

Chores • bump sigs.k8s.io/karpenter to v1.4.2 (#9402) #9402 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.5.8

Chores • bump sigs.k8s.io/karpenter to v1.5.5 (#9401) #9401 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.6.8

Chores • bump sigs.k8s.io/karpenter to v1.6.4 #9400 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.7.6

Chores • bump sigs.k8s.io/karpenter to v1.7.2 #9407 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.8.8

Chores • bump sigs.k8s.io/karpenter to v1.8.3 (#9399) #9399 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.9.2

Chores • bump sigs.k8s.io/karpenter to v1.9.1 #9394 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.10.2

Chores • bump sigs.k8s.io/karpenter to v1.10.1 #9393 (Sarthak Umarani)

github.com

aws/karpenter-provider-aws released v1.11.3

Chores • bump sigs.k8s.io/karpenter to v1.11.2 #9392 (Sarthak Umarani)

github.com