AWS eks documentation change

Service: eks · 2026-01-10 · Documentation low

File: eks/latest/userguide/launch-templates.md

Summary

Added Kubernetes version skew policy requirements and warnings about potential instability when using custom AMIs with version mismatches.

Security assessment

Focuses on operational stability and compatibility requirements, not security vulnerabilities. Warnings about cluster instability are reliability concerns rather than security issues.

Diff

diff --git a/eks/latest/userguide/launch-templates.md b/eks/latest/userguide/launch-templates.md
index 85b6bdcfe..e66399a32 100644
--- a//eks/latest/userguide/launch-templates.md
+++ b//eks/latest/userguide/launch-templates.md
@@ -424 +424,18 @@ You cannot use dynamic parameter references for AMI IDs in Launch Templates used
-When specifying an AMI, Amazon EKS doesn’t merge any user data. Rather, you’re responsible for supplying the required `bootstrap` commands for nodes to join the cluster. If your nodes fail to join the cluster, the Amazon EKS `CreateNodegroup` and `UpdateNodegroupVersion` actions also fail.
+  * When specifying an AMI, Amazon EKS does not validate the Kubernetes version embedded in your AMI against your cluster’s control plane version. You are responsible for ensuring that the Kubernetes version of your custom AMI conforms to the [Kubernetes version skew policy](https://kubernetes.io/releases/version-skew-policy):
+
+    * The `kubelet` version on your nodes must not be newer than your cluster version
+
+    * The `kubelet` version on your nodes must be equal to or up to 3 minor versions behind your cluster version (for Kubernetes version `1.28` or higher), or up to 2 minor versions behind your cluster version (for Kubernetes version `1.27` or lower)
+
+Creating managed node groups with version skew violations may result in:
+
+    * Nodes failing to join the cluster
+
+    * Undefined behavior or API incompatibilities
+
+    * Cluster instability or workload failures
+
+  * When specifying an AMI, Amazon EKS doesn’t merge any user data. Rather, you’re responsible for supplying the required `bootstrap` commands for nodes to join the cluster. If your nodes fail to join the cluster, the Amazon EKS `CreateNodegroup` and `UpdateNodegroupVersion` actions also fail.
+
+
+