← Back to changelog

2026-10-20

Cluster add-on upgrades, with a new node image and safer node repair

#add-on  #kubernetes  #update  #upgrade  #component  #eks  #karpenter 

We are rolling out the October round of cluster add-on upgrades. It ships to non-production clusters first, with production to follow. Most of it is routine patch and minor releases. A few changes are worth knowing about, and one may need a look if you configure Karpenter disruption budgets yourself.

What changed

  • New EKS node image, so every node is replaced once. The node image moves to v20261012, which fixes a kernel panic AWS found in the previous two node images on some instance types. Karpenter replaces your nodes gradually, within your node pools’ disruption budgets, so workloads move the same way they do during any node rotation. We skipped those two affected images on purpose.
  • Karpenter 1.15: node repair now respects your disruption budgets. When a node turns unhealthy, Karpenter replaces it. From this version that repair counts as a disruption, so a budget of nodes: "0" without reasons now blocks repairs as well as consolidation. If you use such a budget to keep nodes stable during working hours, reasons: ["Drifted", "Underutilized", "Empty"] need to be added to it: your nodes stay put as before, and broken ones still get replaced. We already updated every cluster definition that had one.
  • KEDA 2.21 closes a security issue. Service account tokens that KEDA requests are now bound to their intended audience. This only affects a TriggerAuthentication that uses boundServiceAccountToken or Vault’s Kubernetes authentication. We found none on the clusters we checked; if you use either, let us know before your production rollout.
  • Tempo now applies your trace retention again. Since Tempo 3.0, traces were kept for 14 days whatever retention your cluster was set to. With this update the configured retention applies again, so traces older than it are removed once, shortly after the rollout.
  • Stricter StorageClass checks. The EBS CSI driver now rejects a StorageClass with allowedTopologies that names no availability zone. None of the StorageClasses we manage are affected; check any you created yourself.
  • Concourse 8.3.1. If you run Concourse with us, it moves to 8.3.1 with two security fixes. Paths given to pipeline steps can no longer climb out of their directory with ../; adjust any pipeline that relies on that.
  • secrets-store-csi-driver stays on 1.5.6. Newer versions can delete synced Kubernetes Secrets while pods still use them. We upgrade once a release fixes that.

Add-on upgrades

We also picked up the latest EKS build revisions for kube-proxy, metrics-server and the snapshot-controller (packaging updates only, no version change).