AWS eks: EKS Kubernetes 1.37 release notes added; SELinux/kubelet guidance updated
Summary
Adds a new Kubernetes 1.37 section to the EKS version notes (SELinux mount labeling GA, DRA device taints, HPA changes, kubelet config/logging changes, NVIDIA driver 595) and revises the 1.36 SELinux wording and the 1.35 IPVS deprecation note to point at nftables migration.
Security assessment
The change is release-note documentation, not a fix for a specific vulnerability or incident. It does add security-relevant operational guidance: SELinux mount labeling behavior that can hold Pods in ContainerCreating when privileged and unprivileged Pods share a volume (with an action to set seLinuxChangePolicy: Recursive), and a warning that the kubelet now logs its full effective configuration at startup so node logs must be restricted to trusted users. These are hardening/awareness items rather than a patched CVE.
Evidence
+ * **Kubelet Logs Its Configuration at Startup:** The kubelet now logs its full effective configuration at startup. Make sure only trusted users can read node logs. For more information, see [kubernetes/kubernetes#139837](https://github.com/kubernetes/kubernetes/pull/139837).
Diff
diff --git a/eks/latest/userguide/kubernetes-versions-standard.md b/eks/latest/userguide/kubernetes-versions-standard.md index 0750517..d829037 100644 --- a//eks/latest/userguide/kubernetes-versions-standard.md +++ b//eks/latest/userguide/kubernetes-versions-standard.md @@ -7 +7 @@ -Kubernetes 1.36Kubernetes 1.35Kubernetes 1.34 +Kubernetes 1.37Kubernetes 1.36Kubernetes 1.35Kubernetes 1.34 @@ -20,0 +21,38 @@ This topic gives important changes to be aware of for each Kubernetes version in +## Kubernetes 1.37 + +Kubernetes `1.37` is now available in Amazon EKS. For more information about Kubernetes `1.37`, see the [official release announcement](https://kubernetes.io/blog/2026/08/26/kubernetes-v1-37-release/). + +###### Important + + * SELinux Mount Labeling Enabled by Default (GA): In Kubernetes 1.37, the `SELinuxMount` feature is enabled by default. When a Pod sets `seLinuxOptions` and its volume’s CSI driver sets `seLinuxMount: true`, the kubelet mounts the volume with `mount -o context=<label>` instead of relabeling every file. A mount can carry only one SELinux label, so a Pod stays in `ContainerCreating` if another Pod on the same node already uses the same volume with a different SELinux label, a different `seLinuxChangePolicy`, or a different privilege level. Nodes without SELinux enabled aren’t affected. + + * Action required: Before upgrading, run `kubectl get csidriver -o custom-columns=NAME:.metadata.name,SELINUXMOUNT:.spec.seLinuxMount` to find drivers with `seLinuxMount: true`. For volumes from those drivers, find Pods that set `seLinuxOptions` and share a volume. Pods that share a volume must use the same `seLinuxOptions.level` and `seLinuxChangePolicy`. If a privileged Pod and an unprivileged Pod share a volume, set `spec.securityContext.seLinuxChangePolicy: Recursive` on the unprivileged Pod. `Recursive` keeps the previous relabeling behavior; apply it to all Pods that share the volume. For more information, see [SELinux Volume Label Changes goes GA (and likely implications in v1.37)](https://kubernetes.io/blog/2026/04/22/breaking-changes-in-selinux-volume-labeling/) and [KEP-1710](https://kep.k8s.io/1710). + + * EKS Auto Mode Consolidation Default: Starting with Kubernetes 1.37, new EKS Auto Mode NodePools that don’t specify `consolidationPolicy` default to `Balanced` instead of `WhenEmptyOrUnderutilized`. `Balanced` typically results in fewer Pod evictions at roughly the same cost. The built-in `general-purpose` and `system` NodePools also use `Balanced`, and you can’t change this setting on them. For details, see [the EKS Auto Mode release notes](./auto-change.html). + + * Action required: To keep a specific consolidation behavior, set `consolidationPolicy` explicitly on your own NodePools. If a workload needs the previous behavior, target a [NodePool](./associate-workload.html) that sets `consolidationPolicy: WhenEmptyOrUnderutilized`. + + + + + * **Dynamic Resource Allocation (DRA) Device Taints and Tolerations (Stable):** DRA drivers and cluster administrators can taint devices, such as GPUs, so the scheduler doesn’t allocate them to Pods that don’t tolerate the taint. Using DRA on EKS requires installing a DRA driver, which EKS doesn’t install. The NVIDIA DRA driver is supported with Karpenter static capacity, EKS managed node groups, and self-managed nodes. It isn’t supported with EKS Auto Mode. With EKS Auto Mode, or Karpenter dynamic capacity provisioning, use the NVIDIA device plugin. + + * When you create a `DeviceTaintRule`, always set `spec.deviceSelector`. To target all devices, use `deviceSelector: {}`. For more information, see [Use the NVIDIA DRA driver or device plugin on Amazon EKS](./device-management-nvidia-dra-device-plugin.html). + + * **Horizontal Pod Autoscaler Configurable Tolerance (Stable):** You can set a tolerance per HPA, separately for scale up and scale down, instead of relying only on the cluster-wide default of 10%. + + * **Horizontal Pod Autoscaler Scale to Zero (Beta):** The `HPAScaleToZero` feature gate is enabled by default in Kubernetes 1.37. An HPA that scales on Object or External metrics can set `minReplicas: 0` to scale to zero Pods when idle and back up when demand returns. Object and External metrics require a metrics adapter, which EKS doesn’t install. + + * **Kubelet Configuration Changes:** The kubelet no longer starts if a deprecated cAdvisor flag is set (except `--housekeeping-interval`), drops the `container_cpu_load_average_10s`, `container_cpu_load_d_average_10s`, and `container_tasks_state` metrics, and treats `eventRecordQPS: 0` as no limit. Previously `eventRecordQPS: 0` applied a limit of 5 events per second. EKS-optimized AMIs don’t set the deprecated cAdvisor flags or `eventRecordQPS`, so their kubelet startup and rate limit are unchanged. The removed metrics affect anyone who scrapes them, on any AMI. + + * Action required: If you use custom AMIs or extra kubelet arguments, remove the deprecated cAdvisor flags, and if you set `eventRecordQPS: 0`, change it to `5` to keep the previous rate limit. Update any dashboards or alerts that use the removed metrics. For more information, see the [kubelet configuration (v1beta1) reference](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/). + + * **Kubelet Logs Its Configuration at Startup:** The kubelet now logs its full effective configuration at startup. Make sure only trusted users can read node logs. For more information, see [kubernetes/kubernetes#139837](https://github.com/kubernetes/kubernetes/pull/139837). + + * **NVIDIA Driver 595 for Amazon EC2 G7 Instances:** G7 instances require NVIDIA driver 595. The EKS-optimized Amazon Linux 2023 NVIDIA AMIs include driver 595 on all supported versions; the Bottlerocket NVIDIA AMIs include it on Kubernetes 1.37 and later. + + + + +For the complete Kubernetes `1.37` changelog, see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md + @@ -31 +69 @@ Kubernetes `1.36` is now available in Amazon EKS. For more information about Kub - * SELinux Volume Labeling Changes (GA): Faster SELinux volume labeling now defaults to all volumes in Kubernetes 1.36, using `mount -o context` instead of recursive file relabeling. Sharing a volume between privileged and unprivileged Pods on the same node may cause issues. Future Kubernetes releases may introduce additional breaking changes related to this feature. + * SELinux Volume Labeling Changes (GA): In Kubernetes 1.36, faster SELinux volume labeling defaults to all volumes, using `mount -o context` instead of recursive file relabeling. Sharing a volume on the same node between privileged and unprivileged Pods, or between Pods with different SELinux labels, may cause issues. The related `SELinuxMount` behavior that can hold a Pod in `ContainerCreating` is enabled by default in Kubernetes 1.37, not 1.36. Review the Kubernetes 1.37 section before upgrading. @@ -33 +71 @@ Kubernetes `1.36` is now available in Amazon EKS. For more information about Kub - * Action required: Customers running SELinux-enforcing systems should audit clusters and ensure the `seLinuxChangePolicy` field and SELinux volume labels are correctly set on Pods before upgrading. For more information, see [SELinux Volume Label Changes goes GA (and likely implications in v1.37)](https://kubernetes.io/blog/2026/04/22/breaking-changes-in-selinux-volume-labeling/). + * Action required: Before upgrading, audit clusters that run SELinux-enabled nodes and make sure the `seLinuxChangePolicy` field and SELinux volume labels are set correctly on Pods that share a volume. For more information, see [SELinux Volume Label Changes goes GA (and likely implications in v1.37)](https://kubernetes.io/blog/2026/04/22/breaking-changes-in-selinux-volume-labeling/). @@ -98 +136 @@ Kubernetes `1.35` is now available in Amazon EKS. For more information about Kub - * **Deprecation Notice - IPVS Mode:** IPVS mode in kube-proxy is deprecated and will be removed in Kubernetes 1.36. + * **Deprecation Notice - IPVS Mode:** IPVS mode in kube-proxy is deprecated and will be removed in a future Kubernetes release. Migrate to nftables mode. For more information, see [Running kube-proxy in nftables Mode](https://docs.aws.amazon.com/eks/latest/best-practices/nftables.html).