All checks
High EKS · regional

EKS node groups should run on a supported Kubernetes version

Flags Amazon EKS node groups that run on a Kubernetes version older than the current AWS EKS standard support window. Extended-support versions miss bug-fix releases and incur additional fees; unsupported versions stop receiving security patches entirely.

service
EKS
severity
High
scope
evaluated in every region

How to fix it

Upgrade the managed node group to a Kubernetes version still on AWS standard support, and to a current release rather than the oldest that passes today. A node group can never go past the control plane's version, so one already level with it needs the cluster upgraded first. The update replaces the nodes, so every pod moves; a rolling update fails outright if a pod disruption budget blocks a drain, and a force update ignores them.

In the console

EKS → Clusters → the cluster → Compute → Node groups → Update now

With the AWS CLI

aws eks update-nodegroup-version --cluster-name <cluster-name> --nodegroup-name <nodegroup-name> --kubernetes-version <version> --region <region>

With Terraform

resource "aws_eks_node_group" "this" {
  cluster_name    = aws_eks_cluster.this.name
  node_group_name = "example"
  node_role_arn   = aws_iam_role.eks_node.arn
  subnet_ids      = var.private_subnet_ids
  version         = var.kubernetes_version

  scaling_config {
    desired_size = 2
    max_size     = 3
    min_size     = 1
  }
}

See which of your accounts this check is failing on.

Book a demo