AWS eks: Deprecate volume-modifier-for-k8s annotations for EBS volumes
Summary
Adds a deprecation notice and migration guide from volume-modifier-for-k8s annotations to Kubernetes VolumeAttributesClass for modifying EBS volumes in EKS Auto Mode.
Security assessment
The change documents a storage volume modification API migration and deprecation timeline. It does not address a vulnerability, credential handling, encryption, authorization, or other security control.
Evidence
+The [`volume-modifier-for-k8s`](https://github.com/awslabs/volume-modifier-for-k8s) project has been deprecated in favor of the native Kubernetes [`VolumeAttributesClass`](https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/) API.
Diff
diff --git a/eks/latest/userguide/create-storage-class.md b/eks/latest/userguide/create-storage-class.md index c1a71c75d..6a839fe68 100644 --- a//eks/latest/userguide/create-storage-class.md +++ b//eks/latest/userguide/create-storage-class.md @@ -7 +7 @@ -Use self-managed KMS key to encrypt EBS volumesStorageClass Parameters ReferenceConsiderationsInstall CSI Snapshot Controller add-on +Use self-managed KMS key to encrypt EBS volumesStorageClass Parameters ReferenceConsiderationsMigrate from volume-modifier-for-k8s to VolumeAttributesClassInstall CSI Snapshot Controller add-on @@ -196,0 +197,77 @@ The block storage capability of EKS Auto Mode is different from the EBS CSI Driv +###### Annotation-based EBS volume modification is deprecated + +The [`volume-modifier-for-k8s`](https://github.com/awslabs/volume-modifier-for-k8s) project has been deprecated in favor of the native Kubernetes [`VolumeAttributesClass`](https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/) API. This project was used to set annotations on a PersistentVolumeClaim to modify an EBS volume. After October 31, 2026, Amazon EKS Auto Mode no longer supports these annotations. To modify EBS volumes (for example, `type`, `iops`, or `throughput`) after that date, use the Kubernetes `VolumeAttributesClass` API instead. For more information, see [Volume Attributes Classes](https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/) in the Kubernetes documentation. + +## Migrate from volume-modifier-for-k8s to VolumeAttributesClass + +For EKS Auto Mode clusters running Kubernetes 1.34 or later, use a `VolumeAttributesClass` (VAC) to change an EBS volume’s type, IOPS, or throughput. + +Existing PVCs can be migrated in place by creating a VAC and setting `spec.volumeAttributesClassName` on the existing PVC. The PVC and PV are not recreated and there are no interruptions to your workloads during this process. + + 1. Define the volume settings in a VAC + +VMK annotations map to VAC parameters as follows: + +Existing VMK annotation | VAC parameter +---|--- +`ebs.csi.eks.amazonaws.com/volumeType` | type +`ebs.csi.eks.amazonaws.com/iops` | iops +`ebs.csi.eks.amazonaws.com/throughput` | throughput + +Use `type`, not `volumeType`, in the VAC. Values must be strings, and a VAC only needs the parameters relevant to the desired EBS configuration. Example: + + apiVersion: storage.k8s.io/v1 + kind: VolumeAttributesClass + metadata: + name: ebs-auto-gp3-6000-250 + driverName: ebs.csi.eks.amazonaws.com + parameters: + type: gp3 + iops: "6000" + throughput: "250" + +VACs are cluster-scoped, so the manifest has no namespace. Apply it normally: + + kubectl apply -f vac.yaml + + 2. Assign the VAC to the PVC + + VAC_NAME=ebs-auto-gp3-6000-250 + + kubectl patch pvc <pvc-name> -n <namespace> --type=merge \ + -p "{\"spec\":{\"volumeAttributesClassName\":\"${VAC_NAME}\"}}" + + 3. Confirm that the change completed + + kubectl get pvc <pvc-name> -n <namespace> \ + -o custom-columns='NAME:.metadata.name,REQUESTED:.spec.volumeAttributesClassName,CURRENT:.status.currentVolumeAttributesClassName,STATUS:.status.modifyVolumeStatus.status' + +The migration is complete when `REQUESTED` and `CURRENT` contain the same VAC name and `STATUS` is empty. + +If it does not complete, inspect the PVC events: + + kubectl describe pvc <pvc-name> -n <namespace> + +`Pending` usually means the referenced VAC is unavailable. `Infeasible` means the driver rejected the requested EBS parameters; create a valid VAC and assign that instead. + + + + +### Optional: Remove the VMK annotations + +Removing the old annotations is not required for VAC to work. Once a PVC or PV references a VAC, VMK refuses annotation-based modifications and VAC is the authoritative path. + +The annotations may be removed later as configuration cleanup. If they are removed, also update any Helm, GitOps, or other automation that would add them back. VMK status annotations left on the PV are harmless and do not need to be removed. + +### Changing or Reverting the Settings + +VAC parameters are immutable. To change the EBS configuration, create another VAC and assign its name to the PVC. + +To cancel a change that has not completed, restore the previously assigned VAC. If the PVC did not previously use one, clear the field: + + + kubectl patch pvc <pvc-name> -n <namespace> --type=merge \ + -p '{"spec":{"volumeAttributesClassName":null}}' + +Clearing the field does not undo an EBS modification that already completed. To restore previous volume settings, create a VAC containing those settings and assign it to the PVC. Normal EBS parameter constraints and modification cooldowns apply. + @@ -245 +322 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Grant Secret access to LBC +Storage @@ -247 +324 @@ Grant Secret access to LBC -Disable EKS Auto Mode +Security and compliance