EKS node groups should run on a supported Kubernetes version
Flags Amazon EKS node groups that run on a Kubernetes version older than the current AWS EKS standard support window. Extended-support versions miss bug-fix releases and incur additional fees; unsupported versions stop receiving security patches entirely.
- service
- EKS
- severity
- High
- scope
- evaluated in every region
How to fix it
Upgrade the managed node group to a Kubernetes version still on AWS standard support, and to a current release rather than the oldest that passes today. A node group can never go past the control plane's version, so one already level with it needs the cluster upgraded first. The update replaces the nodes, so every pod moves; a rolling update fails outright if a pod disruption budget blocks a drain, and a force update ignores them.
In the console
EKS → Clusters → the cluster → Compute → Node groups → Update now
With the AWS CLI
aws eks update-nodegroup-version --cluster-name <cluster-name> --nodegroup-name <nodegroup-name> --kubernetes-version <version> --region <region>With Terraform
resource "aws_eks_node_group" "this" {
cluster_name = aws_eks_cluster.this.name
node_group_name = "example"
node_role_arn = aws_iam_role.eks_node.arn
subnet_ids = var.private_subnet_ids
version = var.kubernetes_version
scaling_config {
desired_size = 2
max_size = 3
min_size = 1
}
}
See which of your accounts this check is failing on.
Book a demo