Release versions for these AMIs:
+* 1.28.1-20231002
+* 1.27.5-20231002
+* 1.26.8-20231002
+* 1.25.13-20231002
+* 1.24.17-20231002
+* 1.23.17-20231002
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.28.1/20230914/ +* s3://amazon-eks/1.27.5/20230914/ +* s3://amazon-eks/1.26.8/20230914/ +* s3://amazon-eks/1.25.13/20230914/ +* s3://amazon-eks/1.24.17/20230914/ +* s3://amazon-eks/1.23.17/20230914/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.254-170.358.amzn2
+ * Kubernetes 1.24 and above: 5.10.192-183.736.amzn2
+ * Note that the GPU AMI on Kubernetes 1.27 and below will continue to use kernel-5.4 as we work to address a compatibility issue with nvidia-driver-latest-dkms.
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.3
+* runc: 1.1.7-3.amzn2
+* cuda: 12.2.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.2.1630.0-1
Notable changes:
+ - SSM agent upgraded to 3.2.1630.0-1
+ - Update libssh2 for ALAS-2023-2257
Release versions for these AMIs:
+* 1.28.1-20230919
+* 1.27.5-20230919
+* 1.26.8-20230919
+* 1.25.13-20230919
+* 1.24.17-20230919
+* 1.23.17-20230919
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.28.1/20230914/ +* s3://amazon-eks/1.27.5/20230914/ +* s3://amazon-eks/1.26.8/20230914/ +* s3://amazon-eks/1.25.13/20230914/ +* s3://amazon-eks/1.24.17/20230914/ +* s3://amazon-eks/1.23.17/20230914/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.254-170.358.amzn2
+ * Kubernetes 1.24 and above: 5.10.192-183.736.amzn2
+ * Note that the GPU AMI on Kubernetes 1.27 and below will continue to use kernel-5.4 due to a compatibility issue with nvidia-driver-latest-dkms.
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.3
+* runc: 1.1.7-3.amzn2
+* cuda: 12.2.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.2.1542.0-1
Notable changes:
+ - kernel-5.10 updated to address:
+ - ALAS2KERNEL-5.10-2023-039
+ - Add support for Kubernetes 1.28 (#1431)
+ - GPU AMI:
+ - Released with Neuron version 2.14.0
+ - GPU AMIs on Kubernetes 1.28 and above:
+ - Upgraded kernel to 5.10
+ - Upgraded cuda version to 12.2
+ - Upgraded Nvidia driver to 535.54.03-1
+ - Installed EFA version 1.26.1
+ - Limited deeper sleep states
Release versions for these AMIs:
+* 1.27.4-20230825
+* 1.26.7-20230825
+* 1.25.12-20230825
+* 1.24.16-20230825
+* 1.23.17-20230825
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.4/2023-08-16/ +* s3://amazon-eks/1.26.7/2023-08-16/ +* s3://amazon-eks/1.25.12/2023-08-16/ +* s3://amazon-eks/1.24.16/2023-08-16/ +* s3://amazon-eks/1.23.17/2023-08-16/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.253-167.359.amzn2
+ * Kubernetes 1.24 and above: 5.10.186-179.751.amzn2
+ * Note that the GPU AMI will continue to use kernel-5.4 as we work to address a compatibility issue with nvidia-driver-latest-dkms.
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.3
+* runc: 1.1.7-3.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.2.1478.0-1
Notable changes: + - containerd updated to address: + - ALAS2DOCKER-2023-029 + - runc updated to address: + - ALAS2DOCKER-2023-028 + - Fetch new IMDS token for every request. (#1395)
+Release versions for these AMIs:
+* 1.27.3-20230816
+* 1.26.6-20230816
+* 1.25.11-20230816
+* 1.24.15-20230816
+* 1.23.17-20230816
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.3/2023-08-14/ +* s3://amazon-eks/1.26.6/2023-08-14/ +* s3://amazon-eks/1.25.11/2023-08-14/ +* s3://amazon-eks/1.24.15/2023-08-14/ +* s3://amazon-eks/1.23.17/2023-08-15/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.250-166.369.amzn2
+ * Kubernetes 1.24 and above: 5.10.186-179.751.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.7-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.2.1377.0-1
+Notable changes:
+- Install latest runc 1.1.* (#1384).
+- Install latest amazon-ssm-agent from S3 (#1370).
+- kernel updated to address:
+ - ALASKERNEL-5.4-2023-050
+ - ALASKERNEL-5.10-2023-038
Other changes:
+- Do not set KubeletCredentialProviders feature flag for 1.28+ (#1375)
+- Cache IMDS tokens per-user (#1386)
Release versions for these AMIs:
+* 1.27.3-20230728
+* 1.26.6-20230728
+* 1.25.11-20230728
+* 1.24.15-20230728
+* 1.23.17-20230728
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.3/2023-06-30/ +* s3://amazon-eks/1.26.6/2023-06-30/ +* s3://amazon-eks/1.25.11/2023-06-30/ +* s3://amazon-eks/1.24.15/2023-06-30/ +* s3://amazon-eks/1.23.17/2023-06-30/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.249-163.359.amzn2
+ * Kubernetes 1.24 and above: 5.10.184-175.749.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.5-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+- Kernel fix for CVE-2023-3117 and CVE-2023-35001 with new versions: 5.10 kernel and 5.4 kernel
+- Mount bpffs on all supported Kubernetes versions. (#1349)
+- Enable discard_unpacked_layers by default to clean up compressed image layers in containerd's content store.(#1360)
Release versions for these AMIs:
+* 1.27.3-20230711
+* 1.26.6-20230711
+* 1.25.11-20230711
+* 1.24.15-20230711
+* 1.23.17-20230711
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.3/2023-06-30/ +* s3://amazon-eks/1.26.6/2023-06-30/ +* s3://amazon-eks/1.25.11/2023-06-30/ +* s3://amazon-eks/1.24.15/2023-06-30/ +* s3://amazon-eks/1.23.17/2023-06-30/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.247-162.350.amzn2
+ * Kubernetes 1.24 and above: 5.10.184-175.731.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.5-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes: +- Kubelet versions bumped up for k8s version 1.23-1.27 to address bug +- Source VPC CNI plugin version bumped from 0.8.0 to 1.2.0
+Release versions for these AMIs:
+* 1.27.1-20230703
+* 1.26.4-20230703
+* 1.25.9-20230703
+* 1.24.13-20230703
+* 1.23.17-20230703
+* 1.22.17-20230703
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.1/2023-04-19/ +* s3://amazon-eks/1.26.4/2023-05-11/ +* s3://amazon-eks/1.25.9/2023-05-11/ +* s3://amazon-eks/1.24.13/2023-05-11/ +* s3://amazon-eks/1.23.17/2023-05-11/ +* s3://amazon-eks/1.22.17/2023-05-11/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.247-162.350.amzn2
+ * Kubernetes 1.24 and above: 5.10.184-175.731.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.5-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes: +- This is the last AMI release for Kubernetes 1.22 +- Update Kernel to 5.4.247-162.350.amzn2 to address ALASKERNEL-5.4-2023-048, CVE-2023-1206 +- Update Kernel to 5.10.184-175.731.amzn2 to address ALASKERNEL-5.10-2023-035, CVE-2023-1206 +- Use recommended clocksources (#1328) +- Add configurable working directory (#1231) +- Update eni-max-pods.txt (#1330) +- Mount bpffs by default on 1.25+ (#1320)
+Release versions for these AMIs:
+* 1.27.1-20230607
+* 1.26.4-20230607
+* 1.25.9-20230607
+* 1.24.13-20230607
+* 1.23.17-20230607
+* 1.22.17-20230607
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.1/2023-04-19/ +* s3://amazon-eks/1.26.4/2023-05-11/ +* s3://amazon-eks/1.25.9/2023-05-11/ +* s3://amazon-eks/1.24.13/2023-05-11/ +* s3://amazon-eks/1.23.17/2023-05-11/ +* s3://amazon-eks/1.22.17/2023-05-11/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.242-156.349.amzn2
+ * Kubernetes 1.24 and above: 5.10.179-168.710.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.5-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+* 5.4 kernel update to 5.4.242-156.349.amzn2 and 5.10 kernel update to 5.10.179-168.710.amzn2 address CVE-2023-32233
+* Updating runc version to 1.1.5-1.amzn2 which contains fixes for CVE-2023-28642 and CVE-2023-27561.
Release versions for these AMIs:
+* 1.27.1-20230526
+* 1.26.4-20230526
+* 1.25.9-20230526
+* 1.24.13-20230526
+* 1.23.17-20230526
+* 1.22.17-20230526
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.1/2023-04-19/ +* s3://amazon-eks/1.26.4/2023-05-11/ +* s3://amazon-eks/1.25.9/2023-05-11/ +* s3://amazon-eks/1.24.13/2023-05-11/ +* s3://amazon-eks/1.23.17/2023-05-11/ +* s3://amazon-eks/1.22.17/2023-05-11/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.242-155.348.amzn2
+ * Kubernetes 1.24 and above: 5.10.179-166.674.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+* 5.4 kernel update to 5.4.242-155.348.amzn2 addresses CVE ALAS2KERNEL-5.4-2023-045
+* 5.10 kernel update to 5.10.179-166.674.amzn2 addresses ALAS2KERNEL-5.10-2023-032
+* Glib update to glib2-2.56.1-9.amzn2 addresses ALAS-2023-2049
Release versions for these AMIs:
+* 1.27.1-20230513
+* 1.26.4-20230513
+* 1.25.9-20230513
+* 1.24.13-20230513
+* 1.23.17-20230513
+* 1.22.17-20230513
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.27.1/2023-04-19/ +* s3://amazon-eks/1.26.4/2023-05-11/ +* s3://amazon-eks/1.25.9/2023-05-11/ +* s3://amazon-eks/1.24.13/2023-05-11/ +* s3://amazon-eks/1.23.17/2023-05-11/ +* s3://amazon-eks/1.22.17/2023-05-11/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.241-150.347.amzn2
+ * Kubernetes 1.24 and above: 5.10.178-162.673.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes: + - Add support for Kubernetes 1.27 (#1300)
+Other changes: + - Updated max pods for i4g instance types (#1296)
+Release versions for these AMIs:
+* 1.26.2-20230509
+* 1.25.7-20230509
+* 1.24.11-20230509
+* 1.23.17-20230509
+* 1.22.17-20230509
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.26.2/2023-03-17/ +* s3://amazon-eks/1.25.7/2023-03-17/ +* s3://amazon-eks/1.24.11/2023-03-17/ +* s3://amazon-eks/1.23.17/2023-03-17/ +* s3://amazon-eks/1.22.17/2023-03-17/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.241-150.347.amzn2
+ * Kubernetes 1.24 and above: 5.10.178-162.673.amzn2
+* dockerd: 20.10.23-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes: +- The new AMIs have updated docker version 20.10.23-1.amzn2.0.1 that addresses two docker CVEs; CVE-2022-36109 - docker and CVE-2022-37708 - docker. +- For the GPU Variants of these AMIs, the Nvidia Fabric Manager version is upgraded from 470.161.03-1 to 470.182.03-1. +- Fix ECR pattern for aws-cn (#1280) +- Fix imds setting for multiple enis on ipv6 (1275)
+Release versions for these AMIs:
+* 1.26.2-20230501
+* 1.25.7-20230501
+* 1.24.11-20230501
+* 1.23.17-20230501
+* 1.22.17-20230501
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.26.2/2023-03-17/ +* s3://amazon-eks/1.25.7/2023-03-17/ +* s3://amazon-eks/1.24.11/2023-03-17/ +* s3://amazon-eks/1.23.17/2023-03-17/ +* s3://amazon-eks/1.22.17/2023-03-17/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.241-150.347.amzn2
+ * Kubernetes 1.24 and above: 5.10.178-162.673.amzn2
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+- Add bootstrap option to create a local NVMe raid0 or individual volume mounts (#1171)
+- Improve bootstrap logging (#1276)
+- Use credential provider API v1 in 1.27+, v1alpha1 in 1.26- (#1269)
+- Override hostname to match EC2's PrivateDnsName (#1264)
+- Add ethtool (#1261)
+- Update kernel-5.10 for ALASKERNEL-5.10-2023-031
+- Kernel version upgrade to 5.10.178-162.673.amzn2 fixes the Containers failing to create and probe exec errors related to seccomp on recent kernel-5.10 versions issue
Release versions for these AMIs:
+* 1.26.2-20230411
+* 1.25.7-20230411
+* 1.24.11-20230411
+* 1.23.17-20230411
+* 1.22.17-20230411
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.26.2/2023-03-17/ +* s3://amazon-eks/1.25.7/2023-03-17/ +* s3://amazon-eks/1.24.11/2023-03-17/ +* s3://amazon-eks/1.23.17/2023-03-17/ +* s3://amazon-eks/1.22.17/2023-03-17/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.238-148.347.amzn2
+ * Kubernetes 1.24 and above: 5.10.176-157.645.amzn2
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.4
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0
Notable changes:
+- The AMI changes include update for 5.4 kernel version from 5.4.238-148.346.amzn2 to kernel-5.4.238-148.347.amzn2. kernel-5.4.238-148.346 had a fatal issue affecting SMB mounts in which a null pointer dereference caused a panic. As a result, this package was removed from the Amazon Linux 2 repositories.
Release versions for these AMIs:
+* 1.26.2-20230406
+* 1.25.7-20230406
+* 1.24.11-20230406
+* 1.23.17-20230406
+* 1.22.17-20230406
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.26.2/2023-03-17/ +* s3://amazon-eks/1.25.7/2023-03-17/ +* s3://amazon-eks/1.24.11/2023-03-17/ +* s3://amazon-eks/1.23.17/2023-03-17/ +* s3://amazon-eks/1.22.17/2023-03-17/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.238-148.346.amzn2
+ * Kubernetes 1.24 and above: 5.10.173-154.642.amzn2
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.19-1.amzn2.0.1
+* runc: 1.1.4
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0
Notable changes:
+- Add support for Kubernetes 1.26 (#1246)
+- Add support inf2, trn1n instance types (#1251)
+- Updated containerd to address:
+ - ALASDOCKER-2023-023
+- Fixed ecr-credential-provider flags not being passed correctly to kubelet (#1240)
+ - Added --image-credential-provider-config and --image-credential-provider-bin-dir flags to the systemd units.
+ - Set KubeletCredentialProviders feature flag to true in the kubelet JSON config.
Other changes:
+- Use gp3 volume_type for 1.27+ (#1197)
+- Use default kubelet API QPS for 1.27+ (#1241)
+- Remove --container-runtime kubelet flag for 1.27+ (#1250)
Release versions for these AMIs:
+* 1.25.7-20230322
+* 1.24.11-20230322
+* 1.23.17-20230322
+* 1.22.17-20230322
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.25.7/2023-03-17/ +* s3://amazon-eks/1.24.11/2023-03-17/ +* s3://amazon-eks/1.23.17/2023-03-17/ +* s3://amazon-eks/1.22.17/2023-03-17/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.235-144.344.amzn2
+ * Kubernetes 1.24 and above: 5.10.173-154.642.amzn2
+ * The GPU AMI will continue to use kernel-5.4 for all Kubernetes versions as we work to address a compatibility issue with nvidia-driver-latest-dkms (#1222).
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that with Kubernetes 1.25+, Docker is only installed on GPU AMI's. This is subject to change as we remove unnecessary dependencies, and we recommend completing the migration to containerd immediately.
+* containerd: 1.6.6-1.amzn2.0.2
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+- Validate package versionlocks (#1195)
+- Updated kernel-5.4 to address:
+ - ALASKERNEL-5.4-2023-043
+- Updated kernel-5.10 to address:
+ - ALASKERNEL-5.10-2023-027
+ - ALASKERNEL-5.10-2023-028
Release versions for these AMIs:
+* 1.25.6-20230304
+* 1.24.10-20230304
+* 1.23.16-20230304
+* 1.22.17-20230304
+* 1.21.14-20230304
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.25.6/20230130/ +* s3://amazon-eks/1.24.10/20230130/ +* s3://amazon-eks/1.23.16/20230130/ +* s3://amazon-eks/1.22.17/20230130/ +* s3://amazon-eks/1.21.14/20230130/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.231-137.341.amzn2
+ * Kubernetes 1.24 and above: 5.10.167-147.601.amzn2
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that with Kubernetes 1.25+, Docker is only installed on GPU AMI's. This is subject to change as we remove unnecessary dependencies, and we recommend completing the migration to containerd immediately.
+* containerd: 1.6.6-1.amzn2.0.2
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+- This is the last AMI release for Kubernetes 1.21
+- This is the first AMI release available in ap-southeast-4
Minor changes: +- Adds a user guide section about packages in the versionlock file. (#1199)
+Release versions for these AMIs:
+* 1.25.6-20230217
+* 1.24.10-20230217
+* 1.23.16-20230217
+* 1.22.17-20230217
+* 1.21.14-20230217
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.25.6/20230130/ +* s3://amazon-eks/1.24.10/20230130/ +* s3://amazon-eks/1.23.16/20230130/ +* s3://amazon-eks/1.22.17/20230211/ +* s3://amazon-eks/1.21.14/20230130/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.228-132.418.amzn2
+ * Kubernetes 1.24 and above: 5.10.165-143.735.amzn2
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.6-1.amzn2.0.2
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+- Kubernetes 1.24+ now use kernel-5.10 for x86 and ARM AMIs.
+ - The GPU AMI will continue to use kernel-5.4 as we work to address a compatibility issue with nvidia-driver-latest-dkms.
+- The kernel package is now properly version-locked #1191.
+ - See #1193 for more information.
+- New AMIs released for kubernetes version 1.25
+- Pressure stall information (PSI) is now enabled #1161.
Minor changes:
+- Updated eni-max-pods.txt with new instance types.
+- Allow kernel_version to be set to any value (such as 5.15) when building a custom AMI.
Release versions for these AMIs:
+* 1.25.6-20230211
+* 1.24.10-20230211
+* 1.23.16-20230211
+* 1.22.17-20230211
+* 1.21.14-20230211
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.25.6/2023-01-30/ +* s3://amazon-eks/1.24.10/2023-01-30/ +* s3://amazon-eks/1.23.16/2023-01-30/ +* s3://amazon-eks/1.22.17/2023-01-30/ +* s3://amazon-eks/1.21.14/2023-01-30/
+AMI details:
+* kernel:
+ * Kubernetes 1.23 and below: 5.4.228-132.418.amzn2
+ * Kubernetes 1.24 and above: 5.10.165-143.735.amzn2
+* dockerd: 20.10.17-1.amzn2.0.1
+ * Note that Docker is not installed on AMI's with Kubernetes 1.25+.
+* containerd: 1.6.6-1.amzn2.0.2
+* runc: 1.1.4-1.amzn2
+* cuda: 11.4.0-1
+* nvidia-container-runtime-hook: 1.4.0-1.amzn2
+* amazon-ssm-agent: 3.1.1732.0-1.amzn2
Notable changes:
+- This is the first AMI release for Kubernetes 1.25.
+- Kubernetes 1.24+ now use kernel-5.10 for x86 and ARM AMIs.
+ - The GPU AMI will continue to use kernel-5.4 as we work to address a compatibility issue with nvidia-driver-latest-dkms.
+- The kernel package is now version-locked.
Minor changes:
+- Updated eni-max-pods.txt with new instance types.
+- Allow kernel_version to be set to any value (such as 5.15) when building a custom AMI.
+- Fix a misconfiguration in the GPU AMI with containerd's registry certificates. #1168.
Release versions for these AMIs:
+* 1.24.9-20230203
+* 1.23.15-20230203
+* 1.22.17-20230203
+* 1.21.14-20230203
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.24.9/2023-01-11/ +* s3://amazon-eks/1.23.15/2023-01-11/ +* s3://amazon-eks/1.22.17/2023-01-11/ +* s3://amazon-eks/1.21.14/2023-01-11/
+AMI details: +* kernel: 5.4.228-131.415.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.4-1.amzn2 +* cuda: 11.4.0-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes: +* Reverted Use external cloud provider for EKS Local deployments
+Release versions for these AMIs:
+* 1.24.9-20230127
+* 1.23.15-20230127
+* 1.22.17-20230127
+* 1.21.14-20230127
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.24.9/2023-01-11/ +* s3://amazon-eks/1.23.15/2023-01-11/ +* s3://amazon-eks/1.22.17/2023-01-11/ +* s3://amazon-eks/1.21.14/2023-01-11/
+AMI details: +* kernel: 5.4.228-131.415.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.4-1.amzn2 +* cuda: 11.4.0-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes:
+- Updated kernel version to 5.4.228-131.415.amzn2 for:
+ - ALAS2KERNEL-5.4-2023-041.
+- Add support for C6in, M6in, M6idn, R6in, R6idn and Hpc6id instances #1153
+- This is the first AMI release available in ap-south-2, eu-central-2, and eu-south-2.
+- Cache image content without unpacking/snapshotting #1144
+ - Container image caching has been re-enabled for 1.24 AMI's.
Minor changes:
+- Update AWS CLI to 2.9.18
+- Configure containerd registry certificates by default in the GPU AMI.
Release versions for these AMIs:
+* 1.24.7-20230105
+* 1.23.13-20230105
+* 1.22.15-20230105
+* 1.21.14-20230105
+* 1.20.15-20230105
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.24.7/2022-10-31/ +* s3://amazon-eks/1.23.13/2022-10-31/ +* s3://amazon-eks/1.22.15/2022-10-31/ +* s3://amazon-eks/1.21.14/2022-10-31/ +* s3://amazon-eks/1.20.15/2022-10-31/
+AMI details: +* kernel: 5.4.226-129.415.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.4-1.amzn2 +* cuda: 11.4.0-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes:
+- This will be the last release for 1.20 AMI's.
+- Decrease launch_block_device_mappings_volume_size to 4 (#1143).
+ - This fixes an issue with 4GiB launch block devices. More information is available in #1142.
+- Container image caching has been disabled while we work to optimize the disk usage of this feature. This feature was only enabled for 1.24 AMI's in the previous release, v20221222.
Minor changes:
+- Update AWS CLI to 2.9.12
Release versions for these AMIs:
+* 1.24.7-20221222
+* 1.23.13-20221222
+* 1.22.15-20221222
+* 1.21.14-20221222
+* 1.20.15-20221222
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.24.7/2022-10-31/ +* s3://amazon-eks/1.23.13/2022-10-31/ +* s3://amazon-eks/1.22.15/2022-10-31/ +* s3://amazon-eks/1.21.14/2022-10-31/ +* s3://amazon-eks/1.20.15/2022-10-31/
+AMI details: +* kernel: 5.4.226-129.415.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.4-1.amzn2 +* cuda: 11.4.0-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes:
+- Kernel updated to 5.4.226-129.415.amzn2 for:
+ - ALASKERNEL-5.4-2022-040
+ - ALASKERNEL-5.4-2022-039
+- NVIDIA driver updated to 470.161.03-1 to address security issues. More information is available in NVIDIA security bulletin #5415.
+- Cache pause, vpc-cni, and kube-proxy images during build (#938)
+ - Note that this has only been enabled for 1.24 AMIs at this time.
+- Disable yum updates in cloud-init (#1074)
+- Skip sandbox image pull if already present (#1090)
+- Move variable defaults to --var-file (#1079)
Minor changes:
+- Add ECR accounts for eu-south-2, eu-central-2, ap-south-2 (#1125)
+- Handle indentation when parsing sandbox_image from containerd config (#1119)
+- Lookup instanceId using IMDSv2 in Windows log collector script (#1116)
+- Remove aws_region and binary_bucket_region overrides from Makefile (#1115)
+- Sym-link awscli to /bin (#1102)
+- Configure containerd registry certificates by default (#1049)
Release versions for these AMIs:
+* 1.24.7-20221112
+* 1.23.13-20221112
+* 1.22.15-20221112
+* 1.21.14-20221112
+* 1.20.15-20221112
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.24.7/2022-10-31/ +* s3://amazon-eks/1.23.13/2022-10-31/ +* s3://amazon-eks/1.22.15/2022-10-31/ +* s3://amazon-eks/1.21.14/2022-10-31/ +* s3://amazon-eks/1.20.15/2022-10-31/
+AMI details: +* kernel: 5.4.219-126.411.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: runc-1.1.4-1.amzn2 +* cuda: 470.141.03-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes:
+* Upgrades runc to version 1.1.4
+* Updates aws-iam-authenticator to version 0.5.10 and updates kubelet versions to 1.22.15, 1.23.13 and 1.24.7
+* Updates client.authentication.k8s.io to v1beta1
+* Updates credential provider API to beta for Kubernetes versions 1.24+
+* Installs awscli v2 bundle when possible
Release versions for these AMIs:
+* 1.24.6-20221104
+* 1.23.9-20221104
+* 1.22.12-20221104
+* 1.21.14-20221104
+* 1.20.15-20221104
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.24.6/2022-10-05/ +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/
+AMI details: +* kernel: 5.4.219-126.411.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.3-1.amzn2.0.2 +* cuda: 470.141.03-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes:
+* Adds support for 1.24 with version 1.24.6
+* Upgrades kernel at 5.4.219-126.411.amzn2 to address known issues with the previous kernel version
Release versions for these AMIs:
+* 1.23.9-20221101
+* 1.22.12-20221101
+* 1.21.14-20221101
+* 1.20.15-20221101
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/
+AMI details: +* kernel: 5.4.209-116.367.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.3-1.amzn2.0.2 +* cuda: 470.141.03-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes: +* Pin Kernel 5.4 to 5.4.209-116.367 to prevent nodes from going into Unready #1072 +* Increase the kube-api-server QPS from 5/10 to 10/20 #1030 +* Update docker and containerd for ALASDOCKER-2022-021 #1056 +* runc version is updated to 1.1.3-1.amzn2.0.2 to include ALAS2DOCKER-2022-020 #1055 +* Release AMI in me-central-1 with version 1.21, 1.22, 1.23. 1.20 is not supported in this region since it will be deprecated soon. +* Fixes an issue with Docker daemon configuration on the GPU AMI (#351). + * Note that if you have a workaround in place for this issue, you'll likely need to revert it.
+Release versions for these AMIs:
+* 1.23.9-20221027
+* 1.22.12-20221027
+* 1.21.14-20221027
+* 1.20.15-20221027
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/
+AMI details: +* kernel: 5.4.217-126.408.amzn2 +* dockerd: 20.10.17-1.amzn2.0.1 +* containerd: 1.6.6-1.amzn2.0.2 +* runc: 1.1.3-1.amzn2.0.2 +* cuda: 470.141.03-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes: +* cuda is updated to 470.141.03-1. +* Linux kernel is updated to 5.4.217-126.408.amzn2. +* runc version is updated to 1.1.3-1.amzn2.0.2 to include ALAS2DOCKER-2022-020. #1055 +* docker version are update to 20.10.17-1.amzn2.0.1, and containerd version are updated to 1.6.6-1.amzn2.0.2 to include ALASDOCKER-2022-021. #1056 +* Increase the kube-api-server QPS from 5/10 to 10/20. #1030 +* Release AMI in me-central-1 with version 1.21, 1.22, 1.23. 1.20 will not be supported since it will be deprecated soon.
+Release versions for these AMIs:
+* 1.23.9-20220926
+* 1.22.12-20220926
+* 1.21.14-20220926
+* 1.20.15-20220926
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/
+AMI details: +* kernel: 5.4.209-116.367.amzn2 +* dockerd: 20.10.17-1.amzn2 +* containerd: 1.6.6-1.amzn2 +* runc: 1.1.3-1.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable Changes: +* Phase 1 of support for Trn1 instances
+Release versions for these AMIs:
+* 1.23.9-20220914
+* 1.22.12-20220914
+* 1.21.14-20220914
+* 1.20.15-20220914
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/
+AMI details: +* kernel: 5.4.209-116.367.amzn2 +* dockerd: 20.10.17-1.amzn2 +* containerd: 1.6.6-1.amzn2 +* runc: 1.1.3-1.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1732.0-1.amzn2
+Notable changes:
+- The AWS CLI has been updated to (1.25.72)[https://github.com/aws/aws-cli/blob/1.25.72/CHANGELOG.rst#L8] to support local EKS clusters on Outposts.
+- This release fixes an issue with DNS cluster IP and IPv6. More info in #931.
+- Kernel version updated to 5.4.209-116.367.amzn2 as a part of latest CVE patch (ALASKERNEL-5.4-2022-035)[https://alas.aws.amazon.com/AL2/ALASKERNEL-5.4-2022-035.html]
Release versions for these AMIs:
+* 1.23.9-20220824
+* 1.22.12-20220824
+* 1.21.14-20220824
+* 1.20.15-20220824
+* 1.19.15-20220824
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.209-116.363.amzn2 +* dockerd: 20.10.17-1.amzn2 +* containerd: 1.6.6-1.amzn2 +* runc: 1.1.3-1.amzn2-1.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1575.0-1.amzn2
+Notable changes: +* We are updating the versions of docker, containerd and runc as part of this AMI release. +* Kernel version is also updated to include the latest CVE patches +* This is the last release for 1.19 as we are at end of support for 1.19
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.9/2022-07-27/ +* s3://amazon-eks/1.22.12/2022-07-27/ +* s3://amazon-eks/1.21.14/2022-07-27/ +* s3://amazon-eks/1.20.15/2022-07-27/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.204-113.362.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-3.amzn2 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1575.0-1.amzn2
+Notable changes:
+- Kubelet binaries updated, including a backport of #109676.
+- When using containerd as the container runtime, systemd will now be used as the cgroup driver. For more information, see the Kubernetes documentation.
+- Updated aws-neuron-dkms to 2.3.26 to address a security issue. This is a recommended upgrade for all users of the GPU AMI.
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.23.7/2022-06-29/ +* s3://amazon-eks/1.22.9/2022-03-09/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.15/2022-06-20/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.204-113.362.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-3.amzn2 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1575.0-1.amzn2
+Notable changes: +* Release 1.23 AMIs publicly
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.9/2022-03-09/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.15/2022-06-20/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.204-113.362.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-3.amzn2 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1575.0
+Notable changes: +* Updating pause-container version from 3.1 to 3.5 +* Adding log-collector-script to the AMI +* Kernel version upgraded to 5.4.204-113.362.amzn2 for CVE-2022-0494 CVE-2022-0812 CVE-2022-1012 CVE-2022-1184 CVE-2022-1966 CVE-2022-32250 CVE-2022-32296 CVE-2022-32981
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.9/2022-03-09/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.15/2022-06-20/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.196-108.356.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-3.amzn2 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0
+Noted software versions are identical to release v20220620 in the commercial partition.
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.9/2022-03-09/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.15/2022-06-20/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.196-108.356.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-3.amzn2 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0
+Notable changes:
+* Update kubelet binaries for 1.20
+* Support packer's ami_regions feature
+* Increase /var/log/messages limit to 100M
+* Support local cluster in Outposts
+* Adding c6id, m6id, r6id to eni-max-pods.txt
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.9/2022-06-03/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.196-108.356.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-3.amzn2 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0
+Notable changes: +* Containerd version upgraded to 1.4.13-3.amzn2 for CVE-2022-31030. +* Kernel version upgraded to 5.4.196-108.356.amzn2 for CVE-2022-0494, CVE-2022-0854, CVE-2022-1729, CVE-2022-1836, CVE-2022-28893, CVE-2022-29581 +* Updating the kubelet version for 1.22 from 1.22.6 to 1.22.9
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.190-107.353.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-2.amzn2.0.1 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0
+Notable changes: +Linux kernel upgraded to 5.4.190-107.353.
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.12/2022-05-20/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.190-107.353.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-2.amzn2.0.1 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0
+Notable changes: +* Added i4i instance support +* Fixes regression in the docker group ID. AMI build will now fail if the docker group ID is not 1950. +* Removes unused kernels (such as 4.14) during AMI build. This prevents false-positives from automated scanning tools such as AWS Inspector. +* Maintain dockershim compatibility symlink after instance reboot +* Updates 1.21 kubelet version to 1.21.12
+Notice: +* EKS-Optimized AMI SSM parameters contained an incorrect reference to the release version of the AMIs in this release.
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.188-104.359.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-2.amzn2.0.1 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0-1.amzn2
+Notable changes: +* Added c7g support +* When replaying user-data in testing will bail user-data when strict due to moving files
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.188-104.359.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-2.amzn2.0.1 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0-1.amzn2
+Notable changes: +* Includes patched Kernel for CVE-2022-26490, CVE-2022-27666 and CVE-2022-28356 +* New release with AMIs now available in ap-southeast-3
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/
+AMI details: +* kernel: 5.4.188-104.359.amzn2 +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-2.amzn2.0.1 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.1.1188.0
+Notable changes: +- Patches for CVE-2022-0778, CVE-2022-23218 and CVE-2022-23219 have been included. +- Deprecating 1.18 k8s Version
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.181-99.354.amzn2 (1.19 and above), 4.14.268-205.500.amzn2 (1.18 and below) +* dockerd: 20.10.13-2.amzn2 +* containerd: 1.4.13-2.amzn2.0.1 +* runc: 1.0.3-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes: +- Patches for CVE-2022-24769 have been included. +- The bootstrap script will auto-discover maxPods values when instanceType is missing in eni-max-pods.txt
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.22.6/2022-03-09/ +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.181-99.354.amzn2 (1.19 and above), 4.14.268-205.500.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-8.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes: +- Adding support for new k8s version 1.22
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.181-99.354.amzn2 (1.19 and above), 4.14.268-205.500.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-8.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes: +- Update kernel version to 4.14.268-205.500.amzn2 for 1.18 and below, 5.4.181-99.354.amzn2 for 1.19 and above. For more information, see ALAS-2022-1761 and ALASKERNEL-5.4-2022-023.
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.176-91.338.amzn2 (1.19 and above), 4.14.262-200.489.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-8.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes:
+- Update containerd to 1.4.6-8.amzn2 for CVE-2022-23648.
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2022-01-21/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.176-91.338.amzn2 (1.19 and above), 4.14.262-200.489.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes:
+- Upgrade ec2-utils version to 1.2-47, addressing an issue with device symbolic links. More information is available here.
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2022-01-21/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.176-91.338.amzn2 (1.19 and above), 4.14.262-200.489.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes:
+- Support for c6a instance types.
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2022-01-21/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.176-91.338.amzn2 (1.19 and above), 4.14.262-200.489.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02-1 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes:
+- Upgrade kernel version for Kubernetes 1.18 to 4.14.262-200.489.amzn2, addressing several CVE's. More information available in ALAS2-2022-1749
+- Support for hpc6a instance types.
+- Removes support for the chacha20-poly1305@openssh.com cipher, which is not FIPS-compliant.
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2022-01-21/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.172-90.336.amzn2 (1.19 and above), 4.14.256-197.484.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes:
+* Upgrade kernel version for Kubernetes 1.19 and above to 5.4.172-90.336.amzn2.x86_64 for CVE-2022-0185
+* Bug fix in kubelet for 1.21 AMIs to handle compacted IPv6 addresses returned by EC2 API. New Kubelet version: v1.21.5-eks-9017834
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.162-86.275.amzn2 (1.19 and above), 4.14.256-197.484.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0-1.amzn2
+Notable changes: +* Updating aws-cli ( aws-cli/1.22.32 ). Latest CLI is installed using the recommended steps here. This change is specific to this AMI release. +* Added fix to handle failures when serviceIpv6Cidr isn't provided. Related issue: https://github.com/awslabs/amazon-eks-ami/issues/839. +* Added fix to make ipFamily check case-insensitive
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/
+AMI details: +* kernel: 5.4.156-83.273.amzn2 (1.19 and above), 4.14.252-195.483.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0-1.amzn2
+Notable changes: +* Adds new instanceTypes to the eni-max-pods.txt file. +* Patch for AL2/ALAS-2021-1722.
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/ +* s3://amazon-eks/1.17.17/2021-09-02/
+AMI details: +* kernel: 5.4.156-83.273.amzn2 (1.19 and above), 4.14.252-195.483.amzn2 (1.18 and below) +* dockerd: 20.10.7-5.amzn2 +* containerd: 1.4.6-7.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0-1.amzn2
+Notable changes:
+Update containerd to 1.4.6-7.amzn2 and docker to 20.10.7-5.amzn2 to patch vulnerabilities in CVE-2021-41190
Binaries used to build these AMIs are published: +* s3://amazon-eks/1.21.5/2021-11-10/ +* s3://amazon-eks/1.20.11/2021-11-10/ +* s3://amazon-eks/1.19.15/2021-11-10/ +* s3://amazon-eks/1.18.20/2021-09-02/ +* s3://amazon-eks/1.17.17/2021-09-02/
+AMI details: +* kernel: 5.4.149-73.259.amzn2 (1.19 and above), 4.14.252-195.483.amzn2 (1.18 and below) +* dockerd: 20.10.7-3.amzn2 +* containerd: 1.4.6-3.amzn2 +* runc: 1.0.0-2.amzn2 +* cuda: 470.57.02 +* nvidia-container-runtime-hook: 1.4.0-1.amzn2 +* SSM agent: 3.0.1124.0
+Notable changes: +* Upgrade kernel version for 1.17 and 1.18 to 4.14.252-195.483.amzn2 +* Upgrade cuda version from 460.73.01 to 470.57.02 +* Upgrade kubelet version + * 1.19.14 -> 1.19.15 + * 1.20.10 -> 1.20.11 + * 1.21.4 -> 1.21.5 +* Remove cbc ciphers and use following recommended ciphers + * chacha20-poly1305@openssh.com + * aes128-ctr + * aes256-ctr + * aes128-gcm@openssh.com + * aes256-gcm@openssh.com
+Binaries used to build these AMIs are published:
+AMI details:
+Notable changes:
+Binaries used to build these AMIs are published:
+AMI details:
+Notable changes:
+Binaries used to build these AMIs are published:
+AMI details:
+Notable changes: +* Created AMI released on the latest commit
+Binaries used to build these AMIs are published:
+AMI details:
+Notable changes:
+Binaries used to build these AMIs are published:
+s3://amazon-eks/1.20.4/2021-04-12/ +s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+AMI details:
+Notable changes: +* This release includes the patch for the CA to handle Let's Encrypt Certificate Expiry +* Updating default containerd socket path
+Notable changes: +Adding support for new ec2 instance types i.e. m6i
+Notable changes:
+Notable changes:
+pull-sandbox-image.sh c78bb6bNotable changes: +* Contains fix for sanbox-image issue with containerd in Gov-cloud and CN regions. +* Updating to 1.18.20 and 1.19.13 kubernetes version.
+Notable changes: +* This release includes the security patch for the kernel, for CVE-2021-33909.
+EKS AMI release for Kubernetes version 1.21 (1.21 AMIs for GPU and ARM in us-gov-west-1 and us-gov-east-1 are included in this release) +* Note: The containerd has patch for CVE-2-21-32760
+Containerd runtime support +The EKS Optimized Amazon Linux 2 AMI now contains a bootstrap (https://github.com/awslabs/amazon-eks-ami/blob/master/files/bootstrap.sh) flag --container-runtime to optionally enable the containerd runtime. This flag is available in all supported Kubernetes versions of the AMI. This change is to get ahead of the removal of Docker as a supported runtime in Kubernetes (more details here (https://kubernetes.io/blog/2020/12/02/dockershim-faq/)). Feedback is appreciated.
+FIPS Kernel Panic issue on 5.4.X is fixed - https://github.com/awslabs/amazon-eks-ami/issues/632
+EKS AMI release for Kubernetes version 1.21 (1.21 AMIs for GPU and ARM in us-gov-west-1 and us-gov-east-1 aren't a part of this release) +* Note: The containerd has patch for CVE-2-21-32760
+Containerd runtime support +The EKS Optimized Amazon Linux 2 AMI now contains a bootstrap (https://github.com/awslabs/amazon-eks-ami/blob/master/files/bootstrap.sh) flag --container-runtime to optionally enable the containerd runtime. This flag is available in all supported Kubernetes versions of the AMI. This change is to get ahead of the removal of Docker as a supported runtime in Kubernetes (more details here (https://kubernetes.io/blog/2020/12/02/dockershim-faq/)). Feedback is appreciated.
+FIPS Kernel Panic issue on 5.4.X is fixed - https://github.com/awslabs/amazon-eks-ami/issues/632
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.20.4/2021-04-12/ +* s3://amazon-eks/1.19.6/2021-01-05/ +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+AMI details: +* kernel: 5.4.117-58.216.amzn2 (1.19 and above), 4.14.232-177.418.amzn2 (1.18 and below) +* dockerd: 19.03.13ce +* containerd: 1.4.1 +* runc: 1.0.0-rc93 +* cuda: 460.73.01 +* nvidia-container-runtime-hook: 460.73.01 +* SSM agent: 3.0.1295.0
+Notable changes:
+Includes the latest security patches for systemd, python3 and others.
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.20.4/2021-04-12/ +* s3://amazon-eks/1.19.6/2021-01-05/ +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+AMI details: +* kernel: 5.4.117-58.216.amzn2.x86_64 (1.19 and above), 4.14.232-176.381.amzn2.x86_64 (1.18 and below) +* dockerd: 19.03.13-ce +* containerd: 1.4.1 +* runc: 1.0.0-rc93 +* cuda: 460.73.01 +* nvidia-container-runtime-hook: 1.4.0 +* SSM agent: 3.0.1295.0
+Notable changes: +* The SSM Agent will now be automatically installed
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.20.4/2021-04-12/ +* s3://amazon-eks/1.19.6/2021-01-05/ +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+AMI details: +* kernel: 5.4.117-58.216.amzn2.x86_64 (1.19 and above), 4.14.232-176.381.amzn2.x86_64 (1.18 and below) +* dockerd: 19.03.13-ce +* containerd: 1.4.1 +* runc: 1.0.0-rc93 +* cuda: 460.73.01 +* nvidia-container-runtime-hook: 1.4.0
+Notable changes: +* CVE-2021-25215 patch +* kenel patch for following CVEs: CVE-2021-31829, CVE-2021-23133, CVE-2020-29374
+Binaries used to build these AMIs are published: +* s3://amazon-eks/1.20.4/2021-04-12/ +* s3://amazon-eks/1.19.6/2021-01-05/ +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+AMI details: +* kernel: 5.4.110-54.189.amzn2.x86_64 (1.19 and above), 4.14.231-173.361.amzn2.x86_64 (1.18 and below) +* dockerd: 19.03.13-ce +* containerd: 1.4.1 +* runc: 1.0.0-rc93 +* cuda: 460.73.01 +* nvidia-container-runtime-hook: 1.4.0
+Notable changes:
+* runc version upgrade to rc93 for GPU AMIs
+* fix for #2530 backported to rc93 for GPU AMIs
+* runc CVE 2021-30465 patch backported to rc93 for GPU AMIs
Binaries used to build these AMIs are published:
+Notable changes:
+* runc version upgrade to rc93
+* fix for #2530 backported to rc93
+* runc CVE 2021-30465 patch backported to rc93
Binaries used to build these AMIs are published:
+Notable changes: +* Release 1.20 AMIs
+Binaries used to build these AMIs are published:
+s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes:
+Binaries used to build these AMIs are published:
+s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes:
+Binaries used to build these AMIs are published: +s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes:
+A regression was introduced for 1.19 AMI in the last release as a result of runc version update to 1.0.0-rc93 causing nodes to flap between Ready and NotReady, more details #648. We are reverting the runc version back to 1.0.0-rc92.
Binaries used to build these AMIs are published: +s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes: +A regression was introduced to the 4.14 Amazon Linux Kernel where I/O could slow significantly after running some workloads for a long period of time (observations point to between 4 hours and several days). This release contains the Kernel patch which fixes the above issue.
+Binaries used to build these AMIs are published : +s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes :
+- Updates Nvidia drivers to version 460.32.03
+- patch for CVE-2021-27363, CVE-2021-27364, CVE-2021-27365
+- set kubelet log verbosity to 2
Binaries used to build these AMIs are published : +s3://amazon-eks/1.19.6/2021-01-05/ +s3://amazon-eks/1.18.9/2020-11-02/ +s3://amazon-eks/1.17.12/2020-11-02/ +s3://amazon-eks/1.16.15/2020-11-02/ +s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes :
+- Updates Nvidia drivers to version 460.27.04
+- GPU AMIs no longer uses daemon.json defined in https://github.com/awslabs/amazon-eks-ami/blob/master/files/docker-daemon.json
GPU AMIs in this release are not compatible with any eksctl version after eksctl 0.34.0
+Binaries used to build these AMIs are published: +- s3://amazon-eks/1.19.6/2021-01-05/ +- s3://amazon-eks/1.18.9/2020-11-02/ +- s3://amazon-eks/1.17.12/2020-11-02/ +- s3://amazon-eks/1.16.15/2020-11-02/ +- s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes:
+- files/bootstrap.sh: ensure /etc/docker exists before writing to it (#611)
+- GPU AMIs now use docker daemon.json defined in https://github.com/awslabs/amazon-eks-ami/blob/master/files/docker-daemon.json
+- Patch for CVE-2021-3177
+- check that nvidia-smi is configured correctly before updating GPU clocks (#613)
+- Fix Makefile indentation for 1.19 (#616)
+- Increase fs.inotify.max_user_instances to 8192 from the default of 128 (#614)
+- use dynamic lookup of docker gid (#622)
+- bump docker version to 19.03.13ce-1 (#624)
Binaries used to build these AMIs are published : +* s3://amazon-eks/1.19.6/2021-01-05/ +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes : +* Kubernetes versions 1.19+ will now use the 5.4 Linux kernel +* Patch for ALAS-2021-1588
+Binaries used to build these AMIs are published : +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes : +* ARM AMIs built with m6g.large instance type (#601) +* Add Support for c6gn instance type (#597) +* Patch for CVE-2021-3156 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156)
+Binaries used to build these AMIs are published : +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes : +* Update ulimit for memlock to unlimited +* Update ulimit for max_user_watches and max_file_count +* Fix position of sonobuoy e2e registry config check (#590) +* Update Makefile to support sonobuoy e2e registry config override (#588) +* fix syntax error in install script (#582) introduced by #522 +* Feature flag the cleanup of the image (#522) +* Add iptables rule count to log collector +* GPU Boost clock setup for performance improvement (#573) +* add support for sonobuoy e2e registry overrides (#585) for MVP +* ensure kubelet.service.d directory exists (#519) +* (bootstrap): document pause container parameters (#556) +* add SIGKILL to RestartForceExitStatus (#554) +* fix containerd_version typo in Makefile (#584) +* Update systemd to always restart kubelet to support dynamic kubelet configuration (#578) +* Add missing instance types (#580)
+Binaries used to build these AMIs are published : +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes : +* Bug fix for the issue with rngd on EKS worker ami that's built with AL2 source ami. +* Bug fix for grub issue introduced by new nvidia driver +* Patch for CVE-2020-1971 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971)
+Binaries used to build these AMIs are published : +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes :
+Binaries used to build these AMIs are published : +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes : +* Bug fix #526 +* GPU AMIs - Nvidia driver version update to 450.51.06, cuda version update to 11.0 +* Updated kernel version to 4.14.203 and fix for soft lockup issue +* Downgraded containerd version to 1.3.2 to fix pods getting stuck in the Terminating state
+Binaries used to build these AMIs are published : +* s3://amazon-eks/1.18.9/2020-11-02/ +* s3://amazon-eks/1.17.12/2020-11-02/ +* s3://amazon-eks/1.16.15/2020-11-02/ +* s3://amazon-eks/1.15.12/2020-11-02/
+Notable changes : +* Bug fix #526 +* GPU AMIs - Nvidia driver version update to 450.51.06, cuda version update to 11.0 +* Updated kernel version to 4.14.203 and fix for soft lockup issue
+Note: Previous release information can be found from release note
+Changes: +* 0f11f6c Add G4DN instance family to node group template +* ade31b0 Add support for g4 instance family +* d9147f1 sync nodegroup template to latest available
+Changes: +* c1ae2f3 Adding new directory and file for 1.14 and above by removing --allow-privileged=true flag (#327) +* 5335ea8 add support for me-south-1 region (#322) +* c4e03c1 Update list of instance types (#320) +* 389f4ba update S3_URL_BASE environment variable in install-worker.sh
+Kubernetes Changes: +* Kubelet patches with HTTP2-cve +* Kubelet patched with fix for https://github.com/kubernetes/kubernetes/issues/78164
+Note: The AMI no longer contains kubectl. If you rely on kubectl being present, you can download it from the S3 bucket s3://amazon-eks/
Security Note: These AMIs contain OS(AmazonLinux2) patched for CVE-2019-11477, CVE-2019-11478, CVE-2019-11479
+Note: This release also publishes first set of worker AMIs for EKS 1.13 launch
+Security Note: These AMIs contain builds of kubectl & CNI patched for CVE-2019-1002101 and CVE-2019-9946
+Note: This release publishes first set of worker AMIs for EKS 1.12 launch
+Security Note: This AMI contains a build of Docker 17.06 that is patched for CVE-2019-5736
+sed and kubectl configNote: CNI >= 1.2.1 is required for t3 and r5 instance support.
+This project has adopted the Amazon Open Source Code of Conduct. +For more information see the Code of Conduct FAQ or contact +opensource-codeofconduct@amazon.com with any additional questions or comments.
+ + + + + + +Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional +documentation, we greatly value feedback and contributions from our community.
+Please read through this document before submitting any issues or pull requests to ensure we have all the necessary +information to effectively respond to your bug report or contribution.
+We welcome you to use the GitHub issue tracker to report bugs or suggest features.
+When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already +reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
+Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
+To send us a pull request, please:
+make fmt).make test).GitHub provides additional document on forking a repository and +creating a pull request.
+When submitting PRs, we want to verify that there are no regressions in the AMI with the new changes. EKS runs various tests before publishing new Amazon EKS optimized Amazon Linux AMIs, which will ensure the highest level of confidence that there are no regressions in officially published AMIs. To maintain the health of this repo, we need to do some basic validation prior to merging PRs. Eventually, we hope to automate this process. Until then, here are the basic steps that we should take before merging PRs.
+Test #1: Verify that the unit tests pass
+Please add a test case for your changes, if possible. See the unit test README for more information. These tests will be run automatically for every pull request.
+make test
+Test #2: Verify that building AMIs still works
+If your change is relevant to a specific Kubernetes version, build all AMIs that apply. Otherwise, just choose the latest available Kubernetes version.
+# Configure AWS credentials
+make 1.22
+Test #3: Create a nodegroup with new AMI and confirm it joins a cluster
+Once the AMI is built, we need to verify that it can join a cluster. You can use eksctl, or your method of choice, to create a cluster and add nodes to it using the AMI you built. Below is an example config file.
cluster.yaml
apiVersion: eksctl.io/v1alpha5
+kind: ClusterConfig
+
+metadata:
+ name: basic-cluster
+ region: us-west-2
+ version: '1.22'
+
+nodeGroups:
+ - name: ng
+ instanceType: m5.large
+ ami: [INSERT_AMI_ID]
+ overrideBootstrapCommand: |
+ #!/bin/bash
+ /etc/eks/bootstrap.sh basic-cluster
+Then run:
+eksctl create cluster -f cluster.yaml
+eksctl will verify that the nodes join the cluster before completing.
Test #4: Verify that the nodes are Kubernetes conformant
+You can use sonobuoy to run conformance tests on the cluster you've create in Test #2. You should only include nodes with the custom AMI built in Test #1. You must install sonobuoy locally before running.
sonobuoy run --wait
+By default, sonobuoy will run e2e and systemd-logs. This step may take multiple hours to run.
Test #5: [Optional] Test your specific PR changes
+If your PR has changes that require additional, custom validation, provide the appropriate steps to verify that the changes don't cause regressions and behave as expected. Document the steps taken in the CR.
+Clean Up
+Delete the cluster:
+eksctl delete cluster -f cluster.yaml
+Tests fail with realpath: command not found
When running make test, you may see a message like below:
test/test-harness.sh: line 41: realpath: command not found
+/entrypoint.sh: line 13: /test.sh: No such file or directory
+The issue is discussed in this StackExchange post.
+On OSX, running brew install coreutils resolves the issue.
Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels ((enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.
+This project has adopted the Amazon Open Source Code of Conduct. +For more information see the Code of Conduct FAQ or contact +opensource-codeofconduct@amazon.com with any additional questions or comments.
+If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our vulnerability reporting page. Please do not create a public github issue.
+See the LICENSE file for our project's licensing. We will ask you to confirm the licensing of your contribution.
+We may ask you to sign a Contributor License Agreement (CLA) for larger changes.
+ + + + + + +This document includes details about using the AMI template and the resulting AMIs.
+Default values for most variables are defined in a default variable file.
+Users have the following options for specifying their own values:
+PACKER_VARIABLE_FILE argument to make. Values in this file will override values in the default variable file. Your variable file does not need to include all possible variables, as it will be merged with the default variable file.make. These values will override any values that were specified with the first method. In the table below, these variables have a default value of None.++ + +Note +Some variables (such as
+archandkubernetes_version) do not have a sensible, static default, and are satisfied by the Makefile. +Such variables do not appear in the default variable file, and must be overridden (if necessary) by the second method described above.
| Variable | +Default value | +Description | +
|---|---|---|
additional_yum_repos |
+"" |
++ |
ami_component_description |
+(k8s: {{ user `kubernetes_version` }}, docker: {{ user `docker_version` }}, containerd: {{ user `containerd_version` }}) |
++ |
ami_description |
+EKS Kubernetes Worker AMI with AmazonLinux2 image |
++ |
ami_name |
+None | ++ |
ami_regions |
+"" |
++ |
ami_users |
+"" |
++ |
arch |
+None | ++ |
associate_public_ip_address |
+"" |
++ |
aws_access_key_id |
+{{env `AWS_ACCESS_KEY_ID`}} |
++ |
aws_region |
+us-west-2 |
++ |
aws_secret_access_key |
+{{env `AWS_SECRET_ACCESS_KEY`}} |
++ |
aws_session_token |
+{{env `AWS_SESSION_TOKEN`}} |
++ |
binary_bucket_name |
+amazon-eks |
++ |
binary_bucket_region |
+us-west-2 |
++ |
cache_container_images |
+false |
++ |
cni_plugin_version |
+v1.2.0 |
++ |
containerd_version |
+1.6.* |
++ |
creator |
+{{env `USER`}} |
++ |
docker_version |
+20.10.23-1.amzn2.0.1 |
++ |
encrypted |
+false |
++ |
instance_type |
+None | ++ |
kernel_version |
+"" |
++ |
kms_key_id |
+"" |
++ |
kubernetes_build_date |
+None | ++ |
kubernetes_version |
+None | ++ |
launch_block_device_mappings_volume_size |
+4 |
++ |
pause_container_version |
+3.5 |
++ |
pull_cni_from_github |
+true |
++ |
remote_folder |
+/tmp |
+Directory path for shell provisioner scripts on the builder instance | +
runc_version |
+1.1.* |
++ |
security_group_id |
+"" |
++ |
source_ami_filter_name |
+amzn2-ami-minimal-hvm-* |
++ |
source_ami_id |
+"" |
++ |
source_ami_owners |
+137112412989 |
++ |
ssh_interface |
+"" |
++ |
ssh_username |
+ec2-user |
++ |
ssm_agent_version |
+latest |
++ |
subnet_id |
+"" |
++ |
temporary_security_group_source_cidrs |
+"" |
++ |
volume_type |
+gp2 |
++ |
working_dir |
+{{user `remote_folder`}}/worker |
+Directory path for ephemeral resources on the builder instance | +
To build an Amazon EKS Worker AMI with other versions of Kubernetes that are not listed above run the following AWS Command +Line Interface (AWS CLI) commands to obtain values for KUBERNETES_VERSION, KUBERNETES_BUILD_DATE, PLATFORM, ARCH from S3
+#List of all avalable Kuberenets Versions:
+aws s3 ls s3://amazon-eks
+KUBERNETES_VERSION=1.23.9 # Chose a version and set the variable
+
+#List of all builds for the specified Kubernetes Version:
+aws s3 ls s3://amazon-eks/$KUBERNETES_VERSION/
+KUBERNETES_BUILD_DATE=2022-07-27 # Chose a date and set the variable
+
+#List of all platforms available for the selected Kubernetes Version and build date
+aws s3 ls s3://amazon-eks/$KUBERNETES_VERSION/$KUBERNETES_BUILD_DATE/bin/
+PLATFORM=linux # Chose a platform and set the variable
+
+#List of all architectures for the selected Kubernetes Version, build date and platform
+aws s3 ls s3://amazon-eks/$KUBERNETES_VERSION/$KUBERNETES_BUILD_DATE/bin/linux/
+ARCH=x86_64 #Chose an architecture and set the variable
+Run the following command to build an Amazon EKS Worker AMI based on the chosen parameters in the previous step
+make k8s \
+ kubernetes_version=$KUBERNETES_VERSION \
+ kubernetes_build_date=$KUBERNETES_BUILD_DATE \
+ arch=$ARCH
+By default, binaries are downloaded from the Amazon EKS public Amazon Simple Storage Service (Amazon S3) +bucket amazon-eks in us-west-2. You can instead choose to provide your own version of Kubernetes binaries to be used. To use your own binaries
+ aws s3 cp kubelet s3://my-custom-bucket/kubernetes_version/kubernetes_build_date/bin/linux/arch/kubelet
+Note: Replace my-custom-bucket, amazon-eks, kubernetes_version, kubernetes_build_date, and arch with your values.
+Important: You must provide all the binaries listed in the default amazon-eks bucket for a specific kubernetes_version, kubernetes_build_date, and arch combination. These binaries must be accessible through AWS Identity and Access Management (IAM) credentials configured in the Install and configure HashiCorp Packer section.
+make k8s \
+ binary_bucket_name=my-custom-bucket \
+ binary_bucket_region=eu-west-1 \
+ kubernetes_version=1.14.9 \
+ kubernetes_build_date=2020-01-22
+Note: Confirm that the binary_bucket_name, binary_bucket_region, kubernetes_version, and kubernetes_build_date parameters match the path to your binaries in Amazon S3.
+The Makefile runs Packer with the eks-worker-al2.json build specification
+template and the amazon-ebs
+builder. An instance is launched and the Packer Shell
+Provisioner runs the
+install-worker.sh script on the instance to install software and perform other
+necessary configuration tasks. Then, Packer creates an AMI from the instance
+and terminates the instance after the AMI is created.
Optionally, some container images can be cached during the AMI build process in order to reduce the latency of the node getting to a Ready state when launched.
To turn on container image caching:
+cache_container_images=true make 1.23
+When container image caching is enabled, the following images are cached:
+ - 602401143452.dkr.ecr.
The account ID can be different depending on the region and partition you are building the AMI in. See here for more details.
+Since the VPC CNI is not versioned with K8s itself, the latest version of the VPC CNI and the default version, based on the response from the EKS DescribeAddonVersions at the time of the AMI build, will be cached.
+The images listed above are also tagged with each region in the partition the AMI is built in, since images are often built in one region and copied to others within the same partition. Images that are available to pull from an ECR FIPS endpoint are also tagged as such (i.e. 602401143452.dkr.ecr-fips.us-east-1.amazonaws.com/eks/pause:3.5).
When listing images on a node, you'll notice a long list of images. However, most of these images are simply tagged in different ways with no storage overhead. Images cached in the AMI total around 1.0 GiB. In general, a node with no images cached using the VPC CNI will use around 500 MiB of images when in a Ready state with no other pods running on the node.
To build the EKS Optimized AMI, you will need the following permissions:
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "ec2:AttachVolume",
+ "ec2:AuthorizeSecurityGroupIngress",
+ "ec2:CopyImage",
+ "ec2:CreateImage",
+ "ec2:CreateKeypair",
+ "ec2:CreateSecurityGroup",
+ "ec2:CreateSnapshot",
+ "ec2:CreateTags",
+ "ec2:CreateVolume",
+ "ec2:DeleteKeyPair",
+ "ec2:DeleteSecurityGroup",
+ "ec2:DeleteSnapshot",
+ "ec2:DeleteVolume",
+ "ec2:DeregisterImage",
+ "ec2:DescribeImageAttribute",
+ "ec2:DescribeImages",
+ "ec2:DescribeInstances",
+ "ec2:DescribeInstanceStatus",
+ "ec2:DescribeRegions",
+ "ec2:DescribeSecurityGroups",
+ "ec2:DescribeSnapshots",
+ "ec2:DescribeSubnets",
+ "ec2:DescribeTags",
+ "ec2:DescribeVolumes",
+ "ec2:DetachVolume",
+ "ec2:GetPasswordData",
+ "ec2:ModifyImageAttribute",
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ModifySnapshotAttribute",
+ "ec2:RegisterImage",
+ "ec2:RunInstances",
+ "ec2:StopInstances",
+ "ec2:TerminateInstances",
+ "eks:DescribeAddonVersions",
+ "ecr:GetAuthorizationToken"
+ ],
+ "Resource": "*"
+ },
+ {
+ "Effect": "Allow",
+ "Action": [
+ "ecr:BatchGetImage",
+ "ecr:BatchCheckLayerAvailability",
+ "ecr:GetDownloadUrlForLayer"
+ ],
+ "Resource": "arn:aws:ecr:us-west-2:602401143452:repository/*"
+ },
+ {
+ "Effect": "Allow",
+ "Action": [
+ "s3:GetObject"
+ ],
+ "Resource": "arn:aws:s3:::amazon-eks/*"
+ }
+ ]
+}
+You will need to use the region you are building the AMI in to specify the ECR repository resource in the second IAM statement. You may also need to change the account if you are building the AMI in a different partition or special region. You can see a mapping of regions to account ID here. +If you're using a custom s3 bucket to vend different K8s binaries, you will need to change the resource in the third IAM statement above to reference your custom bucket. +For more information about the permissions required by Packer with different configurations, see the docs.
+In some cases, customers may want to customize the kubelet configuration on their nodes, and there are two mechanisms to do that with the EKS Optimized AMI.
+Set the "--kubelet-extra-args" flag when invoking bootstrap.sh
+bootstrap.sh, the script that bootstraps nodes when using the EKS Optimized AMI, supports a flag called --kubelet-extra-args that allows you to pass in additional kubelet configuration. If you invoke the bootstrap script yourself (self-managed nodegroups or EKS managed nodegroups with custom AMIs), you can use that to customize your configuration. For example, you can use something like the following in your userdata:
/etc/eks/bootstrap.sh my-cluster --kubelet-extra-args '--registry-qps=20 --registry-burst=40'
+In this case, it will set registryPullQPS to 20 and registryBurst to 40 in kubelet. Some of the flags, like the ones above, are marked as deprecated and you're encouraged to set them in the kubelet config file (described below), but they continue to work as of 1.23.
Update the kubelet config file
+You can update the kubelet config file directly with new configuration. On EKS Optimized AMIs, the file is stored at /etc/kubernetes/kubelet/kubelet-config.json. It must be valid JSON. You can use a utility like jq (or your tool of choice) to edit the config in your user data:
echo "$(jq ".registryPullQPS=20 | .registryBurst=40" /etc/kubernetes/kubelet/kubelet-config.json)" > /etc/kubernetes/kubelet/kubelet-config.json
+There are a couple of important caveats here:
+kubelet config file after kubelet has already started (i.e. bootstrap.sh already ran), you'll need to restart kubelet to pick up the latest configuration.kubeReserved and evictionHard, so you'd need to modify the config after the bootstrap script is run and restart kubelet to overwrite those properties.View active kubelet config
+When kubelet starts up, it logs all possible flags, including unset flags. The unset flags get logged with default values. These logs do not necessarily reflect the actual active configuration. This has caused confusion in the past when customers have configured the kubelet config file with one value and notice the default value is logged. Here is an example of the referenced log:
Aug 16 21:53:49 ip-192-168-92-220.us-east-2.compute.internal kubelet[3935]: I0816 21:53:49.202824 3935 flags.go:59] FLAG: --registry-burst="10"
+Aug 16 21:53:49 ip-192-168-92-220.us-east-2.compute.internal kubelet[3935]: I0816 21:53:49.202829 3935 flags.go:59] FLAG: --registry-qps="5"
+To view the actual kubelet config on your node, you can use the Kubernetes API to confirm that your configuration has applied.
$ kubectl proxy
+$ curl -sSL "http://localhost:8001/api/v1/nodes/ip-192-168-92-220.us-east-2.compute.internal/proxy/configz" | jq
+
+{
+ "kubeletconfig": {
+ ...
+ "registryPullQPS": 20,
+ "registryBurst": 40,
+ ...
+ }
+}
+By default, the amazon-eks-ami uses a source_ami_filter that selects the latest hvm AL2 AMI for the given architecture as the base AMI. For more information on what kernel versions are running on published Amazon EKS optimized Linux AMIs, see the public documentation.
When building an AMI, you can set kernel_version to customize the kernel version. Valid values are:
+- 4.14
+- 5.4
+- 5.10
If kernel_version is not set:
+- For Kubernetes 1.23 and below, 5.4 is used.
+- For Kubernetes 1.24 and above, 5.10 is used.
The upgrade_kernel.sh script contains the logic for updating and upgrading the kernel.
+files/bootstrap.sh configures the maximum number of pods on a node based off of the number of ENIs available, which is determined by the instance type. Larger instances generally have more ENIs. The number of ENIs limits how many IPV4 addresses are available on an instance, and we need one IP address per pod. You can see this file for the code that calculates the max pods for more information.
To add support for new instance types, at a minimum, we need to update files/eni-max-pods.txt using the amazon-vpc-cni-k8s package. to set the number of max pods available for those instance types. If the instance type is not on the list, bootstrap.sh will fail when the node is started.
$ git clone git@github.com:aws/amazon-vpc-cni-k8s.git
+
+# AWS credentials required at this point
+$ make generate-limits
+# misc/eni-max-pods.txt should be generated
+
+# Copy the generated file to this repo, something like this:
+$ cp misc/eni-max-pods.txt ../amazon-eks-ami/files/
+
+# Verify that expected types were added
+$ git diff
+At this point, you can build an AMI and it will include the updated list of instance types.
+Some packages are critical for correct, performant behavior of a Kubernetes node; such as:
+- kernel
+- containerd
+- runc
++Note +This is not an exhaustive list. The complete list of locked packages is available with
+yum versionlock list.
As a result, these packages should generally be modified within the bounds of a managed process that gracefully handles failures and prevents disruption to the cluster's workloads.
+To prevent unintentional changes, the yum-versionlock plugin is used on these packages.
+If you wish to modify a locked package, you can:
+# unlock a single package
+sudo yum versionlock delete $PACKAGE_NAME
+
+# unlock all packages
+sudo yum versionlock clear
+Prior to Kubernetes 1.27, the kubelet could obtain credentials for ECR out of the box. This legacy credential process has been removed in Kubernetes 1.27, and
+ECR credentials should now be obtained via a plugin, the ecr-credential-provider. This plugin is installed in the AMI at /etc/eks/image-credential-provider/ecr-credential-provider. More information about this plugin is available in the cloud-provider-aws documentation.
Additional image credential provider plugins may be appended to /etc/eks/image-credential-provider/config.json. In Kubernetes versions 1.26 and below, all plugins in this file must support credentialprovider.kubelet.k8s.io/v1alpha1. In Kubernetes versions 1.27 and above, they must support credentialprovider.kubelet.k8s.io/v1.
For more information about image credential provider plugins, refer to the Kubernetes documentation.
+Some instance types launch with ephemeral NVMe instance storage (i3, i4i, c5d, c6id, etc). There are two main ways of utilizing this storage within Kubernetes: a single RAID-0 array for use by kubelet and containerd or mounting the individual disks for pod usage.
+The EKS Optimized AMI includes a utility script to configure ephemeral storage. The script can be invoked by passing the --local-disks <raid0 | mount> flag to the /etc/eks/bootstrap.sh script or the script can be invoked directly at /bin/setup-local-disks. All disks are formatted with an XFS file system.
Below are details on the two disk setup options:
+A RAID-0 array is setup that includes all ephemeral NVMe instance storage disks. The containerd and kubelet state directories (/var/lib/containerd and /var/lib/kubelet) will then use the ephemeral storage for more and faster node ephemeral-storage. The node's ephemeral storage can be shared among pods that request ephemeral storage and container images that are downloaded to the node.
Another way of utilizing the ephemeral disks is to format and mount the individual disks. Mounting individual disks allows the local-static-provisioner DaemonSet to create Persistent Volume Claims that pods can utilize.
+ + + + + + +