How I Upgrade Amazon EKS in Production Without Downtime (Step-by-Step Runbook)

Madialagan Ajith kumara — Mon, 02 Nov 2026 03:06:49 +0000

I run production workloads on Amazon EKS. EKS versions reach end of standard support roughly every 14 months, so upgrades aren't optional. Here's the exact runbook I follow.

Step 1: Check upgrade readiness

aws eks describe-cluster --name my-cluster --query "cluster.version"
aws eks list-insights --cluster-name my-cluster

EKS Upgrade Insights flags deprecated APIs your workloads still use. Fix every "ERROR" before you move on.

Step 2: Scan your manifests for deprecated APIs

pluto detect-helm -o wide
pluto detect-files -d ./k8s-manifests

Step 3: Protect your workloads

Make sure critical apps have at least 2 replicas and a PodDisruptionBudget:

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: app-pdb
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: my-app

Step 4: Upgrade the control plane (one minor version at a time)

eksctl upgrade cluster --name my-cluster --version 1.XX --approve

Step 5: Upgrade managed add-ons

aws eks describe-addon-versions --addon-name vpc-cni --kubernetes-version 1.XX
aws eks update-addon --cluster-name my-cluster --addon-name vpc-cni --addon-version <version>

Repeat for coredns, kube-proxy and aws-ebs-csi-driver.

Step 6: Upgrade node groups

eksctl upgrade nodegroup --name ng-1 --cluster my-cluster --kubernetes-version 1.XX

Managed node groups drain and replace nodes one by one, respecting your PDBs.

Step 7: Verify

kubectl get nodes
kubectl get pods -A | grep -v Running

Lessons learned

Never skip Upgrade Insights
PDBs + 2 replicas = zero downtime
Upgrade add-ons right after the control plane
Do it in a non-prod cluster first

What's your biggest EKS upgrade pain? Let me know in the comments.

How I Passed AWS Solutions Architect Associate (SAA-C03) in 4 Weeks

Madialagan Ajith kumara — Fri, 16 Oct 2026 10:05:42 +0000

I'm a DevOps/Platform Engineer from Sri Lanka, and I passed the AWS Certified Solutions Architect - Associate exam after 4 weeks of preparation. In this post I'll share the exact plan I followed, so you can skip the confusion I had at the start.

Exam at a glance

Item	Details
Exam code	SAA-C03
Questions	65 (multiple choice / multiple response)
Time	130 minutes
Passing score	720 / 1000
Cost	150 USD
Validity	3 years

The 4 domains:

Design Secure Architectures – 30%
Design Resilient Architectures – 26%
Design High-Performing Architectures – 24%
Design Cost-Optimized Architectures – 20%

Notice that security is the biggest chunk. Don't skip IAM.

Step 1: Read the official exam guide (30 minutes)

Download the exam guide from the AWS Certification page. Highlight the in-scope services. This is your syllabus; anything outside it, don't stress about.

Step 2: Create a free-tier account and set a budget alert FIRST

Before touching any service, protect yourself from surprise bills:

Go to Billing → Budgets → Create budget
Choose Zero spend budget
Add your email

Also enable MFA on the root user and create an IAM user for daily work.

Step 3: Learn the core services (2–3 weeks)

Focus your time here, in this order:

IAM – users, roles, policies, least privilege
VPC – subnets, route tables, IGW, NAT Gateway, security groups vs NACLs
EC2 – instance types, pricing models (On-Demand, Reserved, Spot, Savings Plans)
ELB + Auto Scaling – ALB vs NLB, scaling policies
S3 – storage classes, lifecycle rules, versioning, encryption
RDS & Aurora – Multi-AZ vs Read Replicas (this comes up a LOT)
DynamoDB – when to pick NoSQL
Route 53 – routing policies
CloudFront – caching and edge
SQS, SNS, EventBridge – decoupling
Lambda & API Gateway – serverless basics
CloudWatch, CloudTrail – monitoring vs auditing

Step 4: Get hands-on (don't skip this!)

Reading alone won't stick. Build these mini labs:

Launch a web server in a custom VPC
- Create a VPC with 2 public and 2 private subnets
- Launch EC2 in a public subnet, install nginx
- Put an ALB in front with an Auto Scaling group
Host a static website on S3 + CloudFront
Create an RDS database in a private subnet and connect from EC2
Build a serverless API: API Gateway → Lambda → DynamoDB

Delete everything after each lab. Watch out for NAT Gateways and RDS; they cost money even when idle.

Step 5: Learn the "keywords" pattern

SAA questions are scenario-based. The keyword usually tells you the answer:

If the question says...	Think...
"Most cost-effective"	S3 lifecycle, Spot, right-sizing
"Highly available"	Multi-AZ
"Read-heavy workload"	Read Replicas, ElastiCache
"Decouple components"	SQS
"Least operational overhead"	Managed / serverless services
"Disaster recovery across regions"	Cross-region replication, Aurora Global
"Static content, global users"	CloudFront
"Temporary credentials"	IAM Roles, STS

Step 6: Practice exams (1–2 weeks)

Do at least 4–6 full-length practice exams
Aim for 80%+ consistently before booking
Review EVERY wrong answer, and the right ones you guessed
Keep a "mistakes notebook" sorted by domain

Step 7: Exam day tips

Book via Pearson VUE (online or test center)
If taking it online, clear your desk completely and check your webcam the day before
Use flag for review; don't get stuck on one question
Eliminate obviously wrong answers first; usually 2 options are clearly out
There's no penalty for wrong answers, so never leave a question blank

My biggest lessons

1.Networking was my weakest area until I built a VPC by hand

Hands-on practice beats watching videos at 2x speed
Understand why an answer is right, not just memorizing it

Final thoughts

SAA isn't about memorizing every service; it's about thinking like an architect: secure, resilient, fast and cost-effective. Follow these steps, stay consistent, and you'll get there.

If you're preparing right now, drop a comment with your exam date. Happy to answer questions! 🚀

I'm Ajith, a DevOps/Platform Engineer and visiting lecturer. I share DevOps and cloud content

Connect with me on LinkedIn: https://www.linkedin.com/in/ajithkumara-madialagan/

DEV Community: Madialagan Ajith kumara