I run production workloads on Amazon EKS. EKS versions reach end of standard support roughly every 14 months, so upgrades aren't optional. Here's the exact runbook I follow.
Step 1: Check upgrade readiness
aws eks describe-cluster --name my-cluster --query "cluster.version"
aws eks list-insights --cluster-name my-cluster
EKS Upgrade Insights flags deprecated APIs your workloads still use. Fix every "ERROR" before you move on.
Step 2: Scan your manifests for deprecated APIs
pluto detect-helm -o wide
pluto detect-files -d ./k8s-manifests
Step 3: Protect your workloads
Make sure critical apps have at least 2 replicas and a PodDisruptionBudget:
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: app-pdb
spec:
minAvailable: 1
selector:
matchLabels:
app: my-app
Step 4: Upgrade the control plane (one minor version at a time)
eksctl upgrade cluster --name my-cluster --version 1.XX --approve
Step 5: Upgrade managed add-ons
aws eks describe-addon-versions --addon-name vpc-cni --kubernetes-version 1.XX
aws eks update-addon --cluster-name my-cluster --addon-name vpc-cni --addon-version <version>
Repeat for coredns, kube-proxy and aws-ebs-csi-driver.
Step 6: Upgrade node groups
eksctl upgrade nodegroup --name ng-1 --cluster my-cluster --kubernetes-version 1.XX
Managed node groups drain and replace nodes one by one, respecting your PDBs.
Step 7: Verify
kubectl get nodes
kubectl get pods -A | grep -v Running
Lessons learned
- Never skip Upgrade Insights
- PDBs + 2 replicas = zero downtime
- Upgrade add-ons right after the control plane
- Do it in a non-prod cluster first
What's your biggest EKS upgrade pain? Let me know in the comments.
Top comments (0)