AWS eks medium security documentation change
Summary
Removed Extended Support notice for Kubernetes 1.23, added RSS subscription link, and deleted multiple Kubernetes 1.25 AMI version tables containing CVE patches
Security assessment
The removed Kubernetes 1.25 AMI tables contained explicit references to CVE patches (CVE-2024-5321, CVE-2023-5528, CVE-2023-3676, CVE-2023-3893, CVE-2023-3955). Removing these entries indicates deprecation of vulnerable versions, which is security-related as it affects vulnerability management.
Diff
diff --git a/eks/latest/userguide/eks-ami-versions-windows.md b/eks/latest/userguide/eks-ami-versions-windows.md index 8cda64e78..a63f9c331 100644 --- a//eks/latest/userguide/eks-ami-versions-windows.md +++ b//eks/latest/userguide/eks-ami-versions-windows.md @@ -13,4 +12,0 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -###### Important - -Extended Support for Amazon EKS optimized Windows AMIs that are published by AWS isn’t available for Kubernetes version `1.23` but is available for Kubernetes version `1.24` and higher. - @@ -29,0 +26,5 @@ Amazon EKS managed node groups support the November 2022 and later releases of t +To receive notifications of all source file changes to this specific documentation page, you can subscribe to the following URL with an RSS reader: + + + https://github.com/awsdocs/amazon-eks-user-guide/commits/mainline/latest/ug/nodes/eks-ami-versions-windows.adoc.atom + @@ -208,36 +208,0 @@ AMI version | kubelet version | containerd version | csi-proxy version | Release -**Kubernetes version 1.25** - - -AMI version | kubelet version | containerd version | csi-proxy version | Release notes ----|---|---|---|--- -`1.25-2025.04.14` | `1.25.16` | `1.7.20` | `1.1.3` | -`1.25-2025.03.14` | `1.25.16` | `1.7.20` | `1.1.3` | Upgraded `containerd` to `1.7.20`. -`1.25-2025.02.18` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2025.01.15` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.12.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.11.12` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.10.08` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.09.10` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.08.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.07.10` | `1.25.16` | `1.7.11` | `1.1.2` | Includes patches for `CVE-2024-5321`. -`1.25-2024.06.17` | `1.25.16` | `1.7.11` | `1.1.2` | Upgraded `containerd` to `1.7.11`. -`1.25-2024.05.14` | `1.25.16` | `1.6.28` | `1.1.2` | Upgraded `containerd` to `1.6.28`. -`1.25-2024.04.09` | `1.25.16` | `1.6.25` | `1.1.2` | Upgraded `containerd` to `1.6.25`. Rebuilt CNI and `csi-proxy` using `golang 1.22.1`. -`1.25-2024.03.12` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.02.13` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.01.11` | `1.25.16` | `1.6.18` | `1.1.2` | Excluded Standalone Windows Update [KB5034439](https://support.microsoft.com/en-au/topic/kb5034439-windows-recovery-environment-update-for-azure-stack-hci-version-22h2-and-windows-server-2022-january-9-2024-6f9d26e6-784c-4503-a3c6-0beedda443ca) on Windows Server 2022 Core AMIs. The KB applies only to Windows installations with a separate WinRE partition, which aren’t included with any of our Amazon EKS Optimized Windows AMIs. -`1.25-2023.12.12` | `1.25.15` | `1.6.18` | `1.1.2` | -`1.25-2023.11.14` | `1.25.15` | `1.6.18` | `1.1.2` | Includes patches for `CVE-2023-5528`. -`1.25-2023.10.19` | `1.25.14` | `1.6.18` | `1.1.2` | Upgraded `containerd` to `1.6.18`. Upgraded `kubelet` to `1.25.14`. Added new [bootstrap script environment variables](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`SERVICE_IPV4_CIDR` and `EXCLUDED_SNAT_CIDRS`). -`1.25-2023.09.12` | `1.25.12` | `1.6.6` | `1.1.2` | Upgraded the Amazon VPC CNI plugin to use the Kubernetes connector binary, which gets the Pod IP address from the Kubernetes API server. Merged [pull request #100](https://github.com/aws/amazon-vpc-cni-plugins/pull/100). -`1.25-2023.08.17` | `1.25.12` | `1.6.6` | `1.1.2` | Includes patches for `CVE-2023-3676`, `CVE-2023-3893`, and `CVE-2023-3955`. -`1.25-2023.08.08` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.07.11` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.06.20` | `1.25.9` | `1.6.6` | `1.1.1` | Resolved issue that was causing the DNS suffix search list to be incorrectly populated. -`1.25-2023.06.14` | `1.25.9` | `1.6.6` | `1.1.1` | Upgraded Kubernetes to `1.25.9`. Added support for host port mapping in CNI. Merged [pull request #93](https://github.com/aws/amazon-vpc-cni-plugins/pull/93). -`1.25-2023.05.09` | `1.25.7` | `1.6.6` | `1.1.1` | Fixed a bug causing network connectivity [issue #1126](https://github.com/aws/containers-roadmap/issues/1126) on pods after node restart. Introduced a new [bootstrap script configuration parameter](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`ExcludedSnatCIDRs`). -`1.25-2023.04.11` | `1.25.7` | `1.6.6` | `1.1.1` | Added recovery mechanism for `kubelet` and `kube-proxy` on service crash. -`1.25-2023.03.27` | `1.25.6` | `1.6.6` | `1.1.1` | Installed a [domainless gMSA plugin](https://aws.amazon.com/blogs/containers/domainless-windows-authentication-for-amazon-eks-windows-pods) to facilitate gMSA authentication for Windows containers on Amazon EKS. -`1.25-2023.03.20` | `1.25.6` | `1.6.6` | `1.1.1` | -`1.25-2023.02.14` | `1.25.6` | `1.6.6` | `1.1.1` | - @@ -422,36 +386,0 @@ AMI version | kubelet version | containerd version | csi-proxy version | Release -**Kubernetes version 1.25** - - -AMI version | kubelet version | containerd version | csi-proxy version | Release notes ----|---|---|---|--- -`1.25-2025.04.14` | `1.25.16` | `1.7.20` | `1.1.3` | -`1.25-2025.03.14` | `1.25.16` | `1.7.20` | `1.1.3` | Upgraded `containerd` to `1.7.20`. -`1.25-2025.02.18` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2025-01-15` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.12.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.11.12` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.10.08` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.09.10` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.08.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.07.10` | `1.25.16` | `1.7.11` | `1.1.2` | Includes patches for `CVE-2024-5321`. -`1.25-2024.06.17` | `1.25.16` | `1.7.11` | `1.1.2` | Upgraded `containerd` to `1.7.11`. -`1.25-2024.05.14` | `1.25.16` | `1.6.28` | `1.1.2` | Upgraded `containerd` to `1.6.28`. -`1.25-2024.04.09` | `1.25.16` | `1.6.25` | `1.1.2` | Upgraded `containerd` to `1.6.25`. Rebuilt CNI and `csi-proxy` using `golang 1.22.1`. -`1.25-2024.03.12` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.02.13` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.01.09` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2023.12.12` | `1.25.15` | `1.6.18` | `1.1.2` | -`1.25-2023.11.14` | `1.25.15` | `1.6.18` | `1.1.2` | Includes patches for `CVE-2023-5528`. -`1.25-2023.10.19` | `1.25.14` | `1.6.18` | `1.1.2` | Upgraded `containerd` to `1.6.18`. Upgraded `kubelet` to `1.25.14`. Added new [bootstrap script environment variables](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`SERVICE_IPV4_CIDR` and `EXCLUDED_SNAT_CIDRS`). -`1.25-2023.09.12` | `1.25.12` | `1.6.6` | `1.1.2` | Upgraded the Amazon VPC CNI plugin to use the Kubernetes connector binary, which gets the Pod IP address from the Kubernetes API server. Merged [pull request #100](https://github.com/aws/amazon-vpc-cni-plugins/pull/100). -`1.25-2023.08.17` | `1.25.12` | `1.6.6` | `1.1.2` | Includes patches for `CVE-2023-3676`, `CVE-2023-3893`, and `CVE-2023-3955`. -`1.25-2023.08.08` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.07.11` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.06.20` | `1.25.9` | `1.6.6` | `1.1.1` | Resolved issue that was causing the DNS suffix search list to be incorrectly populated. -`1.25-2023.06.14` | `1.25.9` | `1.6.6` | `1.1.1` | Upgraded Kubernetes to `1.25.9`. Added support for host port mapping in CNI. Merged [pull request #93](https://github.com/aws/amazon-vpc-cni-plugins/pull/93). -`1.25-2023.05.09` | `1.25.7` | `1.6.6` | `1.1.1` | Fixed a bug causing network connectivity [issue #1126](https://github.com/aws/containers-roadmap/issues/1126) on pods after node restart. Introduced a new [bootstrap script configuration parameter](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`ExcludedSnatCIDRs`). -`1.25-2023.04.11` | `1.25.7` | `1.6.6` | `1.1.1` | Added recovery mechanism for `kubelet` and `kube-proxy` on service crash. -`1.25-2023.03.27` | `1.25.6` | `1.6.6` | `1.1.1` | Installed a [domainless gMSA plugin](https://aws.amazon.com/blogs/containers/domainless-windows-authentication-for-amazon-eks-windows-pods) to facilitate gMSA authentication for Windows containers on Amazon EKS. -`1.25-2023.03.20` | `1.25.6` | `1.6.6` | `1.1.1` | -`1.25-2023.02.14` | `1.25.6` | `1.6.6` | `1.1.1` | - @@ -636,36 +564,0 @@ AMI version | kubelet version | containerd version | csi-proxy version | Release -**Kubernetes version 1.25** - - -AMI version | kubelet version | containerd version | csi-proxy version | Release notes ----|---|---|---|--- -`1.25-2025.04.14` | `1.25.16` | `1.7.20` | `1.1.3` | -`1.25-2025.03.14` | `1.25.16` | `1.7.20` | `1.1.3` | Upgraded `containerd` to `1.7.20`. -`1.25-2025.02.18` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2025-01-15` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.12.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.11.12` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.10.08` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.09.10` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.08.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.07.10` | `1.25.16` | `1.7.11` | `1.1.2` | Includes patches for `CVE-2024-5321`. -`1.25-2024.06.17` | `1.25.16` | `1.7.11` | `1.1.2` | Upgraded `containerd` to `1.7.11`. -`1.25-2024.05.14` | `1.25.16` | `1.6.28` | `1.1.2` | Upgraded `containerd` to `1.6.28`. -`1.25-2024.04.09` | `1.25.16` | `1.6.25` | `1.1.2` | Upgraded `containerd` to `1.6.25`. Rebuilt CNI and `csi-proxy` using `golang 1.22.1`. -`1.25-2024.03.13` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.02.13` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.01.09` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2023.12.12` | `1.25.15` | `1.6.18` | `1.1.2` | -`1.25-2023.11.14` | `1.25.15` | `1.6.18` | `1.1.2` | Includes patches for `CVE-2023-5528`. -`1.25-2023.10.19` | `1.25.14` | `1.6.18` | `1.1.2` | Upgraded `containerd` to `1.6.18`. Upgraded `kubelet` to `1.25.14`. Added new [bootstrap script environment variables](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`SERVICE_IPV4_CIDR` and `EXCLUDED_SNAT_CIDRS`). -`1.25-2023.09.12` | `1.25.12` | `1.6.6` | `1.1.2` | Upgraded the Amazon VPC CNI plugin to use the Kubernetes connector binary, which gets the Pod IP address from the Kubernetes API server. Merged [pull request #100](https://github.com/aws/amazon-vpc-cni-plugins/pull/100). -`1.25-2023.08.17` | `1.25.12` | `1.6.6` | `1.1.2` | Includes patches for `CVE-2023-3676`, `CVE-2023-3893`, and `CVE-2023-3955`. -`1.25-2023.08.08` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.07.11` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.06.20` | `1.25.9` | `1.6.6` | `1.1.1` | Resolved issue that was causing the DNS suffix search list to be incorrectly populated. -`1.25-2023.06.14` | `1.25.9` | `1.6.6` | `1.1.1` | Upgraded Kubernetes to `1.25.9`. Added support for host port mapping in CNI. Merged [pull request #93](https://github.com/aws/amazon-vpc-cni-plugins/pull/93). -`1.25-2023.05.09` | `1.25.7` | `1.6.6` | `1.1.1` | Fixed a bug causing network connectivity [issue #1126](https://github.com/aws/containers-roadmap/issues/1126) on pods after node restart. Introduced a new [bootstrap script configuration parameter](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`ExcludedSnatCIDRs`). -`1.25-2023.04.11` | `1.25.7` | `1.6.6` | `1.1.1` | Added recovery mechanism for `kubelet` and `kube-proxy` on service crash. -`1.25-2023.03.27` | `1.25.6` | `1.6.6` | `1.1.1` | Installed a [domainless gMSA plugin](https://aws.amazon.com/blogs/containers/domainless-windows-authentication-for-amazon-eks-windows-pods) to facilitate gMSA authentication for Windows containers on Amazon EKS. -`1.25-2023.03.20` | `1.25.6` | `1.6.6` | `1.1.1` | -`1.25-2023.02.14` | `1.25.6` | `1.6.6` | `1.1.1` | - @@ -850,36 +742,0 @@ AMI version | kubelet version | containerd version | csi-proxy version | Release -**Kubernetes version 1.25** - - -AMI version | kubelet version | containerd version | csi-proxy version | Release notes ----|---|---|---|--- -`1.25-2025.04.14` | `1.25.16` | `1.7.20` | `1.1.3` | -`1.25-2025.03.14` | `1.25.16` | `1.7.20` | `1.1.3` | Upgraded `containerd` to `1.7.20`. -`1.25-2025.02.18` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2025-01-15` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.12.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.11.12` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.10.08` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.09.10` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.08.13` | `1.25.16` | `1.7.14` | `1.1.3` | -`1.25-2024.07.10` | `1.25.16` | `1.7.11` | `1.1.2` | Includes patches for `CVE-2024-5321`. -`1.25-2024.06.17` | `1.25.16` | `1.7.11` | `1.1.2` | Upgraded `containerd` to `1.7.11`. -`1.25-2024.05.14` | `1.25.16` | `1.6.28` | `1.1.2` | Upgraded `containerd` to `1.6.28`. -`1.25-2024.04.09` | `1.25.16` | `1.6.25` | `1.1.2` | Upgraded `containerd` to `1.6.25`. Rebuilt CNI and `csi-proxy` using `golang 1.22.1`. -`1.25-2024.03.13` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.02.13` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2024.01.09` | `1.25.16` | `1.6.18` | `1.1.2` | -`1.25-2023.12.12` | `1.25.15` | `1.6.18` | `1.1.2` | -`1.25-2023.11.14` | `1.25.15` | `1.6.18` | `1.1.2` | Includes patches for `CVE-2023-5528`. -`1.25-2023.10.19` | `1.25.14` | `1.6.18` | `1.1.2` | Upgraded `containerd` to `1.6.18`. Upgraded `kubelet` to `1.25.14`. Added new [bootstrap script environment variables](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`SERVICE_IPV4_CIDR` and `EXCLUDED_SNAT_CIDRS`). -`1.25-2023.09.12` | `1.25.12` | `1.6.6` | `1.1.2` | Upgraded the Amazon VPC CNI plugin to use the Kubernetes connector binary, which gets the Pod IP address from the Kubernetes API server. Merged [pull request #100](https://github.com/aws/amazon-vpc-cni-plugins/pull/100). -`1.25-2023.08.17` | `1.25.12` | `1.6.6` | `1.1.2` | Includes patches for `CVE-2023-3676`, `CVE-2023-3893`, and `CVE-2023-3955`. -`1.25-2023.08.08` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.07.11` | `1.25.9` | `1.6.6` | `1.1.1` | -`1.25-2023.06.20` | `1.25.9` | `1.6.6` | `1.1.1` | Resolved issue that was causing the DNS suffix search list to be incorrectly populated. -`1.25-2023.06.14` | `1.25.9` | `1.6.6` | `1.1.1` | Upgraded Kubernetes to `1.25.9`. Added support for host port mapping in CNI. Merged [pull request #93](https://github.com/aws/amazon-vpc-cni-plugins/pull/93). -`1.25-2023.05.09` | `1.25.7` | `1.6.6` | `1.1.1` | Fixed a bug causing network connectivity [issue #1126](https://github.com/aws/containers-roadmap/issues/1126) on pods after node restart. Introduced a new [bootstrap script configuration parameter](./eks-optimized-windows-ami.html#bootstrap-script-configuration-parameters) (`ExcludedSnatCIDRs`). -`1.25-2023.04.11` | `1.25.7` | `1.6.6` | `1.1.1` | Added recovery mechanism for `kubelet` and `kube-proxy` on service crash. -`1.25-2023.03.27` | `1.25.6` | `1.6.6` | `1.1.1` | Installed a [domainless gMSA plugin](https://aws.amazon.com/blogs/containers/domainless-windows-authentication-for-amazon-eks-windows-pods) to facilitate gMSA authentication for Windows containers on Amazon EKS. -`1.25-2023.03.20` | `1.25.6` | `1.6.6` | `1.1.1` | -`1.25-2023.02.14` | `1.25.6` | `1.6.6` | `1.1.1` | -