AWS eks documentation change
Summary
Removed Kubernetes 1.23 documentation and related deprecation notes
Security assessment
Change removes documentation for an older Kubernetes version and associated deprecation notices (like dockershim removal). No specific security vulnerability is mentioned - appears to be routine version lifecycle management.
Diff
diff --git a/eks/latest/userguide/kubernetes-versions-extended.md index 72c816d0d..bb5d6025e 100644 --- a/eks/latest/userguide/kubernetes-versions-extended.md +++ b/eks/latest/userguide/kubernetes-versions-extended.md @@ -5 +5 @@ -Kubernetes 1.28Kubernetes 1.27Kubernetes 1.26Kubernetes 1.25Kubernetes 1.24Kubernetes 1.23 +Kubernetes 1.28Kubernetes 1.27Kubernetes 1.26Kubernetes 1.25Kubernetes 1.24 @@ -157,38 +156,0 @@ For the complete Kubernetes `1.24` changelog, see [https://github.com/kubernetes -## Kubernetes 1.23 - -Kubernetes `1.23` is now available in Amazon EKS. For more information about Kubernetes `1.23`, see the [official release announcement](https://kubernetes.io/blog/2021/12/07/kubernetes-1-23-release-announcement/). - -###### Important - - * The Kubernetes in-tree to container storage interface (CSI) volume migration feature is enabled. This feature enables the replacement of existing Kubernetes in-tree storage plugins for Amazon EBS with a corresponding Amazon EBS CSI driver. For more information, see [Kubernetes 1.17 Feature: Kubernetes In-Tree to CSI Volume Migration Moves to Beta](https://kubernetes.io/blog/2019/12/09/kubernetes-1-17-feature-csi-migration-beta/) on the Kubernetes blog. - -The feature translates in-tree APIs to equivalent CSI APIs and delegates operations to a replacement CSI driver. With this feature, if you use existing `StorageClass`, `PersistentVolume`, and `PersistentVolumeClaim` objects that belong to these workloads, there likely won’t be any noticeable change. The feature enables Kubernetes to delegate all storage management operations from the in-tree plugin to the CSI driver. If you use Amazon EBS volumes in an existing cluster, install the Amazon EBS CSI driver in your cluster before you update your cluster to version `1.23`. If you don’t install the driver before updating an existing cluster, interruptions to your workloads might occur. If you plan to deploy workloads that use Amazon EBS volumes in a new `1.23` cluster, install the Amazon EBS CSI driver in your cluster before deploying the workloads your cluster. For instructions on how to install the Amazon EBS CSI driver on your cluster, see [Store Kubernetes volumes with Amazon EBS](./ebs-csi.html). - - * Extended Support for Amazon EKS optimized Windows AMIs that are published by AWS isn’t available for Kubernetes version `1.23` but is available for Kubernetes version `1.24` and higher. - - - - - * Kubernetes stopped supporting `dockershim` in version `1.20` and removed `dockershim` in version `1.24`. For more information, see [Kubernetes is Moving on From Dockershim: Commitments and Next Steps](https://kubernetes.io/blog/2022/01/07/kubernetes-is-moving-on-from-dockershim/) in the Kubernetes blog. Amazon EKS will end support for `dockershim` starting in Amazon EKS version `1.24`. Starting with Amazon EKS version `1.24`, Amazon EKS official AMIs will have `containerd` as the only runtime. - -Even though Amazon EKS version `1.23` continues to support `dockershim`, we recommend that you start testing your applications now to identify and remove any Docker dependencies. This way, you are prepared to update your cluster to version `1.24`. For more information about `dockershim` removal, see [Migrate from dockershim to containerd](./dockershim-deprecation.html). - - * Kubernetes graduated `IPv4`/`IPv6` dual-stack networking for Pods, services, and nodes to general availability. However, Amazon EKS and the Amazon VPC CNI plugin for Kubernetes don’t support dual-stack networking. Your clusters can assign `IPv4` or `IPv6` addresses to Pods and services, but can’t assign both address types. - - * Kubernetes graduated the Pod Security Admission (PSA) feature to beta. The feature is enabled by default. For more information, see [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) in the Kubernetes documentation. PSA replaces the [Pod Security Policy](https://aws.github.io/aws-eks-best-practices/security/docs/pods/#pod-security-solutions) (PSP) admission controller. The PSP admission controller isn’t supported and is scheduled for removal in Kubernetes version `1.25`. - -The PSP admission controller enforces Pod security standards on Pods in a namespace based on specific namespace labels that set the enforcement level. For more information, see [Pod Security Standards (PSS) and Pod Security Admission (PSA)](https://aws.github.io/aws-eks-best-practices/security/docs/pods/#pod-security-standards-pss-and-pod-security-admission-psa) in the Amazon EKS best practices guide. - - * The `kube-proxy` image deployed with clusters is now the [minimal base image](https://gallery.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-iptables) maintained by Amazon EKS Distro (EKS-D). The image contains minimal packages and doesn’t have shells or package managers. - - * Kubernetes graduated ephemeral containers to beta. Ephemeral containers are temporary containers that run in the same namespace as an existing Pod. You can use them to observe the state of Pods and containers for troubleshooting and debugging purposes. This is especially useful for interactive troubleshooting when `kubectl exec` is insufficient because either a container has crashed or a container image doesn’t include debugging utilities. An example of a container that includes a debugging utility is [distroless images](https://github.com/GoogleContainerTools/distroless#distroless-container-images). For more information, see [Debugging with an ephemeral debug container](https://kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/#ephemeral-container) in the Kubernetes documentation. - - * Kubernetes graduated the `HorizontalPodAutoscaler` `autoscaling/v2` stable API to general availability. The `HorizontalPodAutoscaler` `autoscaling/v2beta2` API is deprecated. It will be unavailable in `1.26`. - - * The [goaway-chance](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/) option in the Kubernetes API server helps prevent `HTTP/2` client connections from being stuck on a single API server instance, by randomly closing a connection. When the connection is closed, the client will try to reconnect, and will likely land on a different API server as a result of load balancing. Amazon EKS version `1.23` has enabled `goaway-chance` flag. If your workload running on Amazon EKS cluster uses a client that is not compatible with [HTTP GOAWAY](https://www.rfc-editor.org/rfc/rfc7540#section-6.8), we recommend that you update your client to handle `GOAWAY` by reconnecting on connection termination. - - - - -For the complete Kubernetes `1.23` changelog, see [https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md#changelog-since-v1220](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md#changelog-since-v1220). -