Learn how to build an AI-powered migration assessment agent using Amazon Bedrock AgentCore and the Strands Agents SDK. The agent reads application source code and container artifacts, scores Amazon EKS migration readiness, identifies blockers by severity, and generates an actionable migration plan with target architecture recommendations.

Learn how athenahealth used Amazon EKS Hybrid Nodes to modernize latency-sensitive healthcare workloads on premises, cutting response times in half, reducing hardware and operational costs by 50%, and maintaining a single Kubernetes operating model across its data center and the cloud while meeting HITRUST and data residency requirements.

A workload spread across three Availability Zones does not necessarily stay spread. This post explains why soft topology spread constraints drift after a node-availability gap, measures the cost, and shows how the Kubernetes descheduler restores even pod distribution on Amazon EKS without downtime and without forcing hard constraints.

What's Changed • fix(boot-hook): poll managed interfaces from netmanager cache by @mselim00 in https://github.com/awslabs/amazon-eks-ami/pull/2821 • feat: use igzip for decompression by @fletcherw in https://github.com/awslabs/amazon-eks-ami/pull/2828 • chore(nodeadm): bump gover to 1.26.8 by @mselim00 in https://github.com/awslabs/amazon-eks-ami/pull/2829 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260917...v20260923

Choosing the right edge container strategy across many locations can fragment your fleet into dozens of special cases. This post shows how to avoid that by standardizing on Amazon EKS, then choosing a deployment model per site: gate on connectivity, then match to existing infrastructure, so every edge runs the same Kubernetes standard.

<p>Amazon EMR on EKS now supports interactive Apache Spark sessions with Spark Connect. Data engineers and data scientists can develop and debug Apache Spark applications interactively from managed notebooks in Amazon SageMaker Unified Studio and their own IDEs, such as Jupyter and Visual Studio Code, with Spark running on the Amazon EKS clusters they already operate. &nbsp;</p> <p>An interactive session provides a persistent Spark context that spans across cells and scripts, letting you blend local Python code execution with remote Spark operations. Spark Connect's client-server architecture decouples your application client from the Spark driver and allows you to maintain your preferred development environment and tooling while Spark runs on your Amazon EKS cluster. This architecture supports workflows including ad hoc data exploration and incremental PySpark job development before deploying to production. Each session runs as pods on a virtual cluster, secured with your AWS Identity and Access Management (IAM) execution role and tagged by project and user.</p> <p>Spark Connect on Amazon EMR on EKS is available with EMR release 7.14 (Apache Spark 3.5) and emr-spark-8.1.0 (Apache Spark 4.1), in all AWS Commercial Regions. The Amazon SageMaker Unified Studio experience is available in <a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/supported-regions.html">supported AWS Regions</a>.</p> <p>To get started, visit the <a href="https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-spark-connect.html">Spark Connect on Amazon EMR on EKS documentation</a> or the <a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/notebooks-spark-connect.html#spark-connect-emr-eks">Amazon SageMaker Unified Studio Getting Started guide.</a></p>

<p>Today, AWS announces that Amazon EMR on EKS now supports running workloads on IPv6 Amazon Elastic Kubernetes Service (Amazon EKS) clusters. Amazon EMR on EKS enables data platform and analytics teams to run open-source big data frameworks such as Apache Spark and Apache Flink on Amazon EKS. With IPv6 support, teams operating at scale can now run these workloads on IPv6 Amazon EKS clusters, giving them access to the vastly larger address space of IPv6 as their analytics workloads grow.</p> <p>You can now scale large Spark and Flink workloads using the expanded IPv6 address space, which removes the need for IPv4 conservation workarounds such as secondary CIDR ranges or prefix delegation. High-executor jobs, such as 500-executor Spark jobs, can run concurrently without planning around address limits. To submit workloads, use StartJobRun, Spark Connect Interactive Endpoints, and Amazon SageMaker Unified Studio with no additional configuration, while the Flink, Livy, and Spark Operators are also supported. This capability is available at no additional cost, starting with Amazon EMR releases emr-7.14.0 and emr-spark-8.0.0.</p> <p>IPv6 cluster support is available in all AWS Regions where Amazon EMR on EKS and IPv6 Amazon EKS clusters are available.</p> <p>Amazon EMR on EKS IPv6 cluster support includes detailed setup instructions and documentation on supported submission models. Visit the <a href="https://aws.amazon.com/emr/features/eks/">Amazon EMR on EKS product page</a> and the <a href="https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/emr-eks-ipv6.html">IPv6 documentation</a> to learn more.&nbsp;</p>

An incident is the worst moment to discover you cannot trust your Amazon EKS dashboard. This post shows what a trustworthy single-pane NOC for Amazon EKS on Amazon CloudWatch looks like, why each design choice matters, and how to get one running in your account in about 15 minutes.

Learn how to scope Amazon ECR image pull permissions to individual Kubernetes pods on a multi-tenant Amazon EKS cluster using KEP 4412 credential providers and ECR repository deny policies, so teams sharing the same nodes can pull only their own container images.

Highlights NVIDIA driver installation has been reworked (#2819). The NVIDIA accelerated AL2023 AMIs now bakes two driver versions; R580 and R595, into the image as pre-built driver trees. On first boot a node inspects its attached GPUs and instance type, then activates the driver version and flavor (open, proprietary, or grid) that its hardware needs. If you encounter unexpected behavior on your GPU nodes, please open an issue or an AWS Support Case. What's Changed • feat(nvidia): bake lts and pb driver trees, resolve one at boot by @kummatty in https://github.com/awslabs/amazon-eks-ami/pull/2819 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260911...v20260917

ReadyOn runs a multi-tenant platform on Amazon EKS that handles highly sensitive enterprise data. This post describes their Four Walls model: four independent layers of tenant isolation combining Kubernetes namespaces, Karpenter node pools, Amazon VPC security groups, and per-tenant Amazon Aurora databases for zero-trust defense in depth.

Equinix, the world's digital infrastructure company, built a shared services architecture on Amazon EKS to eliminate the operational sprawl of its self-managed Kubernetes environment. Learn how a multi-account North Star architecture centralized governance and shared services, delivering 4x faster deployments and 40% less operational overhead.

What's Changed • refactor: Use Hashicorp's HCL2 for the AL2023 Template + added an init target that helps setup the amazon plugin by @Youssef-Beltagy in https://github.com/awslabs/amazon-eks-ami/pull/2804 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260903...v20260911

AWS EBS CSI Driver CHANGELOG See CHANGELOG for full list of changes

A Helm chart for AWS EBS CSI Driver

<p>AWS Private Certificate Authority (AWS Private CA) announces the availability of the AWS Private CA Connector for Kubernetes as a managed Amazon EKS add-on and the AWS Private CA Connector for Active Directory in AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. These launches expand certificate automation capabilities available to AWS GovCloud (US) customers managing government workloads.</p> <p>The AWS Private CA Connector for Kubernetes EKS add-on provides simplified installation, configuration, and lifecycle management through the EKS console, CLI, and API. The connector works with cert-manager to automate certificate requests, distribution to Kubernetes secrets, and renewal, enabling TLS for ingress controllers and securing service-to-service communication in service meshes such as Istio and Linkerd.</p> <p>The AWS Private CA Connector for Active Directory enables AWS GovCloud (US) customers to use AWS Private CA as their certificate authority for Active Directory-enrolled objects. The connector provides automatic certificate issuance to domain-joined users, computers, and other objects through familiar Microsoft certificate enrollment interfaces, supporting enterprise scenarios including smart card authentication, LDAPS, and network device authentication (802.1x).</p> <p>AWS Private CA secures private key material using FIPS 140-3 Level 3 hardware security modules (HSMs).</p> <p>To get started, see the <a href="https://aws.amazon.com/private-ca/">AWS Private CA product page</a>, the <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html">Amazon EKS add-ons user guide</a>, and the <a href="https://docs.aws.amazon.com/privateca/latest/userguide/connector-for-ad.html">AWS Private CA Connector for Active Directory documentation</a>.</p>

What's Changed • feat: speed up node boot by @fletcherw in https://github.com/awslabs/amazon-eks-ami/pull/2793 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260827...v20260903

What's Changed • Use stdlib maps and slices instead of x/exp by @v47 in https://github.com/kubernetes-sigs/kro/pull/1345 • fix(graph): key extended CEL env cache by schema, not just var name by @pujitha24 in https://github.com/kubernetes-sigs/kro/pull/1340 • fix(helm): repair chart template gaps found during review by @armanfeyzi in https://github.com/kubernetes-sigs/kro/pull/1307 • feat(chart): add user role aggregation to view, edit and admin ClusterRole by @reshnm in https://github.com/kubernetes-sigs/kro/pull/1342 • fix(instance): set ResourcesReady=False with ReconciliationSuspended reason when suspended by @RohanKaran in https://github.com/kubernetes-sigs/kro/pull/1282 • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /tools/lsp/server in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1336 • chore(deps): bump golang.org/x/net from 0.47.0 to 0.55.0 in the go-security-updates group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1335 • fix(cel): prevent panic when uint/bytes CEL values reach deep-copy by @pujitha24 in https://github.com/kubernetes-sigs/kro/pull/1346 • feat: add shortNames and categories in the RGD by @fabianburth in https://github.com/kubernetes-sigs/kro/pull/1347 • helm: add extraEnv support to deployment template by @n3rdc4ptn in https://github.com/kubernetes-sigs/kro/pull/1349 • feat(cel): add deepMerge() for recursive nested map merging by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1348 • fix: Support ordered deletion without desired-state projection, CEL evaluation, GraphRevision resolution or external observation by @tomasaschan in https://github.com/kubernetes-sigs/kro/pull/1318 • fix(logging): route klog to zap and make zap-devel configurable in Helm by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1352 • test: raise coverage on pkg/cel/library and pkg/graph/crd/compat by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1357 • chore(deps): bump all project dependencies by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1356 • chore(deps): enable Dependabot version updates and widen module coverage by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1358 • chore(deps): bump actions/setup-node from 5.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1359 • chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1361 • chore(deps): bump actions/checkout from 5.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1360 • chore(deps): bump the npm-security-updates group across 1 directory with 6 updates by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1363 • refactor: scaffolding for graph development work; incremental from #1355 by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1365 • fix(simpleschema): sort synthesized CRD required fields for deterministic output by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1366 • chore(deps): bump @babel/core from 7.28.4 to 7.29.7 in /website in the npm-security-updates group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1364 • lint: bump golangci-lint to v2.12.2 and update lint configuration by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1368 • refactor(watch): extract shared informer-fleet Manager into pkg/watch by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1370 • test: unify integration test suites under a single shared control plane by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1371 • docs: note that lists built from maps need sort() for stable ordering by @allamand in https://github.com/kubernetes-sigs/kro/pull/1375 • fix(crd): detect additionalPrinterColumns changes when updating CRDs by @pujitha24 in https://github.com/kubernetes-sigs/kro/pull/1378 • chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.0 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1383 • fix(helm): honor service account automount setting by @immanuwell in https://github.com/kubernetes-sigs/kro/pull/1380 • chore(deps-dev): bump @types/vscode from 1.125.0 to 1.134.0 in /tools/lsp/client in the npm-version-updates group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1381 • chore(deps): bump softprops/action-gh-release from 2.4.1 to 3.0.2 by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1382 • chore: update e2e test for termination and fix ALLOW_CRD_DELETION correctly by @Skarlso in https://github.com/kubernetes-sigs/kro/pull/1384 • chore(deps): bump the npm-version-updates group across 2 directories with 6 updates by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1387 • chore(deps): bump Go modules, npm packages and GitHub Actions by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1389 • Enable full CEL expressions support for external collection selectors by @tbarizien in https://github.com/kubernetes-sigs/kro/pull/1230 • Bump kro version to 0.9.4 with docs cut by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1394 New Contributors • @v47 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1345 • @pujitha24 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1340 • @armanfeyzi made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1307 • @reshnm made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1342 • @RohanKaran made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1282 • @n3rdc4ptn made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1349 • @immanuwell made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1380 • @Skarlso made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1384 • @tbarizien made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1230 Full Changelog: https://github.com/kubernetes-sigs/kro/compare/v0.9.3...v0.9.4

A Helm chart for AWS EBS CSI Driver

When you scale AI inference on Amazon EKS, every new pod must load model weights into GPU memory before serving traffic. We investigated where cold-start time goes and found two configuration-only changes to Run:ai Model Streamer that cut model startup time by 80-93% on subsequent launches, with no code changes.

Learn how to use a Kyverno mutating admission policy to automatically inject corporate proxy environment variables into Amazon EKS on AWS Fargate pods at admission time, delivering consistent egress compliance without modifying application deployment manifests.

<p>Amazon EMR on EKS lets you run open-source big data frameworks such as Apache Spark and Flink on AWS EKS(Elastic Kubernetes Service) clusters. You submit jobs to a virtual cluster, which maps to a namespace on an EKS cluster, and EMR on EKS handles packaging, scheduling, and running your applications. Today, we are excited to announce job run admission control on EMR EKS with support for job run concurrency and backpressure signals from StartJobRun API. </p> <p>With this launch, you can now set concurrent job limits on a virtual cluster, giving you fine-grained control over how many job runs execute at once and how many can wait in queue. This is a logical queue representing jobs in PENDING/SUBMITTED state. These controls help you protect shared EKS clusters from being overloaded in multi-tenant shared environments and avoid noisy-neighbor scheduling failures, so your critical workloads keep running predictably even under heavy demand.&nbsp;You configure two optional limits on a virtual cluster: maxConcurrentJobRuns, the maximum number of jobs running at any time, and maxInQueueJobRuns, the maximum queue depth for job runs that EMR on EKS has accepted but not yet started running. When the queue is full, StartJobRun returns an HTTP ValidationException, so you can gracefully shed or reroute traffic to another cluster instead of overwhelming a single one. You can view current limits and live job counts at any time with DescribeVirtualCluster. No limits are applied by default, so existing workloads are unaffected until you opt in.&nbsp;</p> <p>Concurrent job limits are available in all AWS Regions where EMR on EKS is offered. To get&nbsp;started, see <a href="https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/virtual-cluster.html#virtual-cluster-job-concurrency-limits">managing virtual clusters. </a></p>

What's Changed • fix: wait for systemd restart to complete by @fletcherw in https://github.com/awslabs/amazon-eks-ami/pull/2785 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260818...v20260827

AWS EBS CSI Driver CHANGELOG See CHANGELOG for full list of changes

A Helm chart for AWS EBS CSI Driver

Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure.

<p>Amazon Elastic Kubernetes Service (Amazon EKS) now supports multiple external OpenID Connect (OIDC) identity providers per cluster. You can associate up to 10 OIDC identity providers with a single cluster, giving you more flexibility in how you authenticate users and workloads to your Kubernetes clusters.<br> <br> Many organizations use different identity providers for different user populations, such as employees, contractors, and CI/CD systems. You can now associate each of these providers directly with your cluster, without consolidating users into a single provider or running an intermediary identity broker. Each provider is configured and managed independently, so each population authenticates through its own provider and identity mapping. Your existing IAM authentication continues to work alongside every configured provider. You add each provider the same way as before, using the AWS Management Console or the AssociateIdentityProviderConfig API through the AWS CLI and AWS SDKs.<br> <br> This capability is available at no additional cost in all AWS Regions where Amazon EKS is available. To learn more, see <a href="https://docs.aws.amazon.com/eks/latest/userguide/authenticate-oidc-identity-provider.html">Grant users access to Kubernetes with an external OIDC provider</a> in the Amazon EKS User Guide.</p>

<p>The Amazon Elastic Kubernetes Service (Amazon EKS) Capability for Argo CD now supports custom configuration through a standard argocd-cm ConfigMap in your cluster. This capability gives you a fully managed GitOps continuous delivery experience, and you can now tune it to fit how your teams work. You can define custom health checks for your Custom Resources, customize the Argo CD UI banner content, adjust how the capability watches and compares the resources it manages, and more. You configure these settings the same way you do in upstream Argo CD, and AWS applies them to your managed capability.</p> <p>With this launch, cluster administrators now have more control over how Argo CD reports application health. By default, Argo CD has no built-in health logic for Custom Resources, so an Application can report as healthy while its resources are still provisioning, and sync waves can advance before those resources are ready. With a custom health check, you define this logic yourself. For example, a health check for a database resource can hold an Application at progressing until the database is ready. The capability also includes built-in health checks for AWS Controllers for Kubernetes (ACK) and kro (Kube Resource Orchestrator) resources, so these report accurate health with no additional configuration.</p> <p>You can configure the EKS Capability for Argo CD in all AWS Regions where the capability is available. To learn more, see <a href="https://aws.amazon.com/eks/">Amazon EKS</a> and <a href="https://docs.aws.amazon.com/eks/latest/userguide/argocd-configure-settings.html">Configure Argo CD settings</a> in the Amazon EKS User Guide.</p> <h4>&nbsp;</h4>

Chores • Cherry-picks for v1.14.1 (#9507) #9507 (Ryan Mistretta) • bump core karpenter and cherrypick #9483 (#9525) #9525 (Ryan Mistretta) Commits • test: split scheduling test suite into two (#9517) #9517 (Ryan Mistretta)

Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260810...v20260818

<p>Today, Amazon Elastic Kubernetes Service (Amazon EKS) announced certificate authority (CA) rotation, enabling customers to rotate their cluster's CA through a managed lifecycle with automated safeguards. Each Amazon EKS cluster has its own CA that allows encrypted connections to the cluster's Kubernetes API, and now you can rotate the CA before it expires to ensure your cluster remains operational and secure.</p> <p>Amazon EKS clusters created since launch in 2018 have CAs with a 10-year validity period, and clusters from that era are now approaching the point where CA rotation activities should begin. CA rotation in Amazon EKS is a shared responsibility. Amazon EKS manages the rotation lifecycle and automatically updates AWS-managed components to trust the successor CA. Customers are responsible for replacing their worker nodes and updating external clients to trust the successor CA before it is activated. EKS Auto Mode instances and AWS Fargate nodes are updated automatically by AWS, but customers are still responsible for updating any external clients that connect to the cluster's API server. Amazon EKS provides automated safeguards to support customers through this process, including advance notifications before CA expiration, automatic appending of a successor CA if one is not created by the customer, and automatic activation if the customer does not activate on their own schedule. A rollback capability allows customers to revert to the previous CA to resolve any issues that may arise with their updates during the transition to the successor CA.</p> <p>Amazon EKS CA rotation is available at no additional cost in all commercial AWS Regions. To get started with CA rotation, you can use the AWS CLI, EKS APIs, CloudFormation, and the AWS console. For more information, see the <a href="https://docs.aws.amazon.com/eks/latest/userguide/certificate-authority-rotation.html">Amazon EKS documentation</a>&nbsp;and&nbsp;<a href="https://aws.amazon.com/blogs/containers/deep-dive-into-amazon-eks-certificate-authority-rotation/">Deep dive into Amazon EKS certificate authority rotation</a>.</p>

Amazon EKS now provides a managed, non-disruptive lifecycle for rotating your cluster's certificate authority (CA), with automated safeguards and rollback. This deep dive explains how CA rotation works, what AWS handles versus what you must update, and how to walk through the rotation lifecycle on your own timeline.

AWS EBS CSI Driver CHANGELOG See CHANGELOG for full list of changes

A Helm chart for AWS EBS CSI Driver

What's Changed • Add support for GDRCopy gdrdrv kernel driver by @erezzarum in https://github.com/awslabs/amazon-eks-ami/pull/2736 New Contributors • @erezzarum made their first contribution in https://github.com/awslabs/amazon-eks-ami/pull/2736 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260801...v20260810

<p><a href="https://aws.amazon.com/pm/eks/" target="_blank" rel="noopener noreferrer">Amazon Elastic Kubernetes Service (Amazon EKS)</a> now supports configuring parameters for Kubernetes control plane components including the scheduler, controller manager, and API server. You can tune pod placement strategies to improve resource utilization, adjust how quickly horizontal pod autoscaling responds to changes in demand, set resource lifecycle parameters such as event retention duration, and more.<br> <br> Cluster administrators now have more control over Kubernetes control plane parameters beyond the defaults. For example, you can set the scheduler's node resource fit strategy parameter to <i>MostAllocated</i>, which packs pods onto nodes that are already well utilized and helps you run the same workloads on fewer nodes. The default <i>LeastAllocated</i> strategy spreads pods across nodes, and you can keep it where headroom matters more than density.<br> <br> You can configure Kubernetes control plane parameters in any AWS Region where Amazon EKS is available. For the full list of configurable parameters and to learn more, see Control plane configuration in the <a href="https://docs.aws.amazon.com/eks/latest/userguide/control-plane-configuration.html" target="_blank" rel="noopener noreferrer">Amazon EKS User Guide</a>.</p>

Amazon EKS 1.34 makes the Kubelet Checkpoint API functional, so you can capture a running container's full state (memory, processes, and network connections) without stopping the workload. This post shows how to deploy an unprivileged checkpoint agent that stores forensic checkpoints in Amazon ECR as OCI images for later analysis.

With Amazon EKS, you can now configure Kubernetes control plane components (the API server, scheduler, and controller manager) directly through EKS APIs. This post explains what's configurable and includes two hands-on walkthroughs: enabling MostAllocated bin-packing to optimize pod placement, and tuning event retention duration.

On Amazon EKS Auto Mode, node failures are detected, drained, and replaced automatically before anyone reaches for a laptop. This post shows how the Node Monitoring Agent and Karpenter form a detect-and-replace cycle that runs by default, why specific faults trigger node replacement, and how to collect node diagnostics without SSH.

What's Changed • feat(nodeadm): add more variables to maxPodsExpression by @joshuakguo in https://github.com/awslabs/amazon-eks-ami/pull/2777 • feat: add multi-EBS volume storage support for AL2023 nodes by @maitreya526 in https://github.com/awslabs/amazon-eks-ami/pull/2759 New Contributors • @joshuakguo made their first contribution in https://github.com/awslabs/amazon-eks-ami/pull/2777 Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260728...v20260801

Documentation Thanks to all our contributors!💜💜💜 ⚠️ Action Required Gateway API CRD Updates (All Gateway API users) Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller. Why: This release requires Gateway API CRDs v1.6.0. The controller is built against this version for conformance and feature support Important: Update CRDs before upgrading the controller. If you upgrade the controller first, NLB Gateway (TCPRoute/UDPRoute/TLSRoute) will be automatically disabled until the CRDs are updated. Since the standard install no longer serves v1alpha2, you must update any existing v1alpha2 route manifests to gateway.networking.k8s.io/v1 Action: Apply v1.6 Gateway CRDs kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml LBC Gateway CRD Updates (All Gateway API users) Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller. Why: This release adds v1 as the storage version for LBC-specific Gateway CRDs (LoadBalancerConfiguration, TargetGroupConfiguration, ListenerRuleConfiguration), with v1beta1 marked as deprecated. The controller reads v1 only, but existing v1beta1 resources are transparently converted to v1 by the API server — no immediate manifest changes required. However, v1beta1 will stop being served in a future release. We recommend updating your manifests to use gateway.k8s.aws/v1 at your earliest convenience. Action: Apply the updated LBC Gateway CRDs: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml 🚀What's New Gateway API v1 Graduation This release graduates Gateway API support to v1 for L4 routes. TCPRoute and UDPRoute now use the stable gateway.networking.k8s.io/v1 API version (previously v1alpha2), and the controller passes Gateway API conformance v1.6.0. The AWS-vended Gateway API CRDs have been upgraded to v1 accordingly. 🔧Enhancements and Fixes Certificate Management • Fix ACM certificate creation for Ingresses with wildcard hosts — the character in hostname was breaking ACM tag validation Certificate list support for ECDSA/RSA use • Add certificate management controller flag to helm chart Route Precedence • Unified cross-kind route precedence for HTTPRoute/GRPCRoute, single code path eliminates non-transitivity • Fix non-transitive rule precedence for routes without hostnames Networking • Filter EndpointSlices by IP family for target group registration • Match hosted zones by longest suffix in GetHostedZoneID • Fix: ICMP Type/Code constants • Fix: render feature gates as parseable key-value pairs Module & Build • Module path updated to sigs.k8s.io/aws-load-balancer-controller/v3. Users who are importing the code base will need to adjust their imports accordingly. Helm • Correct enableEndpointSlices default in Helm values comment 📖 Documentation Updates • Add guidance on migrating between services without downtime • Clarify scheme change replacement behavior • Fix Markdown formatting of blue/green guide • Fix stale contributor setup and invalid IAM role ARN examples • Fix doc annotation name • Fix admonition indentation for ipam-ipv4-pool-id annotation • Clarify WAF addon ownership and document IngressGroup security risks • Remove CloudFormation link What's Changed • Fix Markdown formatting of blue/green guide by @Tenzer in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4835 • ci: Add GO-2026-5932 to govulncheck ignore list by @shraddhabang in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4839 • use /v3 in module name by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4770 • feat(gateway): Use Gateway API v1 for TCPRoute and UDPRoute by @nicomazzarello in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4829 • upgrade AWS vended Gateway API CRDs to v1 by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4844 • update code to use v1 crds by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4845 • Add label for accessing secrets - to support restricted access for EKS Auto LBC by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4838 • docs: fix admonition indentation for ipam-ipv4-pool-id annotation by @nikhilmaheshwari24 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4837 • v1.6.0 conformance + rule refactor by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4861 • fix: handle invalid condition name for tgb by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4862 • Fix ACM certificate creation for Ingresses with wildcard hosts by @nbr in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4786 • docs: clarify scheme change replacement by @kappa8219 in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4860 • fix: use "/" separator in getCacheKey to avoid TGB cache collisions by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4864 • fix: subnet auto-discovery to IPv6-capable subnets for dualstack ip address type by @jupdec in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4865 • Add ipv6 check for tests by @wweiwei-li in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4868 • cut v3.5.0 release by @wweiwei-li in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4869 New Contributors • @Tenzer made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4835 • @nicomazzarello made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4829 • @nikhilmaheshwari24 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4837 • @kappa8219 made their first contribution in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4860 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.4.2...v3.5.0

Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260724...v20260728

Documentation Thanks to all our contributors!💜💜💜 ⚠️ Action Required Double check your ALB rule limits, when using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated. Users who specify multiple hostnames per route will want to double check their ALB limits. https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4863/changes/2c657342ff09998a92fddf1fbcb945ecc7ef612a CRD Updates • No CRD updates required for this release. IAM Policy Updates • No IAM policy changes required for this release. Gateway API updates • No Gateway API CRD updates required for this release. 🔧 Enhancements and Fixes [Rule precedence] - When using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated. [Validation Fix] - Fixed a bug that let invalid protocol types get ignored, rather than throwing a validation error. [Process Crash] - Fixed a bug that caused a NPE when an invalid pod health condition was present. What's Changed • V3.4.3 by @zac-nixon in https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/4863 Full Changelog: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v3.4.2...v3.4.3

<p><a href="https://aws.amazon.com/eks/" target="_blank" rel="noopener noreferrer">Amazon Elastic Kubernetes Service</a> (Amazon EKS) now supports <a href="https://docs.aws.amazon.com/eks/latest/userguide/vpc-interface-endpoints.html#oidc-vpc-interface-endpoints" target="_blank" rel="noopener noreferrer">AWS PrivateLink for the cluster OIDC discovery and JWKS endpoint</a>. You can now reach the endpoint used by <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" target="_blank" rel="noopener noreferrer">IAM roles for service accounts (IRSA)</a> privately from your VPC without requiring internet egress.<br> <br> Each EKS cluster publishes public signing keys at its OIDC endpoint for IRSA. With AWS PrivateLink for the cluster OIDC endpoint, tools running inside your VPC, such as eksctl, Terraform, or custom token validators, can now reach the OIDC discovery document and JWKS privately by creating an interface VPC endpoint for the com.amazonaws.&lt;region&gt;.oidc-eks service. This enables IRSA setup and token validation in VPCs without internet egress and ensures correct DNS resolution when the EKS management VPC endpoint is enabled with private DNS.<br> <br> AWS PrivateLink for the cluster OIDC endpoint is available at no additional cost beyond standard <a href="https://aws.amazon.com/privatelink/pricing/" target="_blank" rel="noopener noreferrer">AWS PrivateLink pricing</a> in all AWS Regions where Amazon EKS is available. To get started, see <a href="https://docs.aws.amazon.com/eks/latest/userguide/vpc-interface-endpoints.html#oidc-vpc-interface-endpoints" target="_blank" rel="noopener noreferrer">Access the cluster OIDC endpoint using AWS PrivateLink</a> in the Amazon EKS User Guide.</p>

<p><a href="https://aws.amazon.com/pm/eks">Amazon EKS</a> now delivers faster pod autoscaling across all <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-provisioned-control-plane.html">Provisioned Control Plane</a> clusters by increasing <a href="https://kubernetes.io/docs/concepts/workloads/autoscaling/horizontal-pod-autoscale/">Horizontal Pod Autoscaler (HPA)</a> sync concurrency to up to 40 times the default Kubernetes value. This reduces the time it takes for HPA-driven workloads to scale in response to increased load, enabling faster responsiveness to demand.<br> <br> The Kubernetes Horizontal Pod Autoscaler (HPA) continuously monitors workload metrics and adjusts pod counts to match demand. In clusters running hundreds or thousands of HPA objects, the speed at which the Kubernetes control plane processes these objects determines how quickly workloads scale in response to changing demand. The HPA sync concurrency setting controls how many HPA objects the control plane evaluates in parallel. By increasing this value, Provisioned Control Plane clusters now process more HPA objects simultaneously, reducing the time between detecting increased load and scaling out pods.<br> <br> This enhancement is available to all customers using EKS Provisioned Control Plane and requires no configuration changes. To learn more about this enhancement, see EKS Provisioned Control Plane in the EKS <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-provisioned-control-plane.html">User Guide</a>.</p>

AWS EBS CSI Driver CHANGELOG See CHANGELOG for full list of changes

A Helm chart for AWS EBS CSI Driver

What's Changed • cut docs v0.9.2 by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1281 • Bump upload-pages-artifact to v5 to fix SHA pinning violation by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1285 • chore(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 in /cmd/kro in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1272 • Update gcb-docker-gcloud builder image to fix push-images job by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1286 • Reapply "Emit instance condition telemetry" by @michaelhtm in https://github.com/kubernetes-sigs/kro/pull/1287 • update zoom link for community meeting by @jlbutler in https://github.com/kubernetes-sigs/kro/pull/1291 • Fix nil pointer dereference in ExternalDocs conversion by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1299 • fix: instance deletion stuck when SSA field manager owns finalizer by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1260 • fix: recover panics in dynamic controller instance reconcile by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1311 • pkg/graph: expose options for NewBuilder() by @neolit123 in https://github.com/kubernetes-sigs/kro/pull/1305 • fix(cel): accept whole-valued float64 for integer-typed schema fields by @RanMarkovich in https://github.com/kubernetes-sigs/kro/pull/1304 • chore: bump go.opentelemetry.io/otel to v1.44.0 to patch CVE by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1312 • Update 02-conditional-creation.md by @deogratias-saidi in https://github.com/kubernetes-sigs/kro/pull/1306 • Update KRO version to 0.9.2 in docs by @jehof in https://github.com/kubernetes-sigs/kro/pull/1297 • Fix RGD CRD description examples to match parser behavior by @iammerus in https://github.com/kubernetes-sigs/kro/pull/1321 • Add author-defined custom status conditions to RGD instances by @lalitg327 in https://github.com/kubernetes-sigs/kro/pull/1301 • fix: build package paths instead of single files in Makefile and CI by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1323 • docs(website): fix broken relative links in overview and resource-basics by @numb86 in https://github.com/kubernetes-sigs/kro/pull/1315 • Update condition telemetry to reflect author conditions by @lalitg327 in https://github.com/kubernetes-sigs/kro/pull/1325 • docs: Helm does not update CRDs when upgrading to latest by @johanngoltz in https://github.com/kubernetes-sigs/kro/pull/1326 • chore(deps): bump the go_modules group across 2 directories with 1 update by @dependabot[bot] in https://github.com/kubernetes-sigs/kro/pull/1320 • Compute condition duration metric at scrape time via a Collector by @lalitg327 in https://github.com/kubernetes-sigs/kro/pull/1329 • Fix custom conditions status flow and tighten build-time validation by @cheeseandcereal in https://github.com/kubernetes-sigs/kro/pull/1331 • KREP-024: Graph — atomic composition primitive by @ellistarn in https://github.com/kubernetes-sigs/kro/pull/1302 • feat(graph): allow schema.* references in instance status expressions by @jakobmoellerdev in https://github.com/kubernetes-sigs/kro/pull/1300 • cut docs v0.9.3 by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1333 • set KRO version to 0.9.3 by @NicholasBlaskey in https://github.com/kubernetes-sigs/kro/pull/1334 New Contributors • @cheeseandcereal made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1311 • @neolit123 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1305 • @RanMarkovich made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1304 • @deogratias-saidi made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1306 • @jehof made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1297 • @iammerus made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1321 • @lalitg327 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1301 • @numb86 made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1315 • @johanngoltz made their first contribution in https://github.com/kubernetes-sigs/kro/pull/1326 Full Changelog: https://github.com/kubernetes-sigs/kro/compare/v0.9.2...v0.9.3

Full Changelog: https://github.com/awslabs/amazon-eks-ami/compare/v20260714...v20260724

In this post, we walk through how zonal shift integrates with Amazon Elastic Kubernetes Service (Amazon EKS) and what happens when a shift is triggered. We also show how to enable it on both self-managed Karpenter and EKS Auto Mode (EKS Auto) clusters.