Review release notes for Kubernetes versions on standard support

User Namespaces (Stable): User Namespaces provides defense-in-depth by mapping a container’s root user to a non-privileged user on the host, ensuring that a container breakout grants no administrative power over the node.

Resource Health Status (Beta): Reports per-device health in Pod status, allowing operators to determine whether a crash loop is due to an Unhealthy or Unknown device status rather than application issues. Works with both Device Plugins and Dynamic Resource Allocation.

Dynamic Resource Allocation Features (Beta): Several DRA features are now enabled by default: Partitionable Devices and Consumable Capacity for more granular sharing of hardware like GPUs, and Device Binding Conditions for thorough device readiness checks before scheduling.

Deprecation Notice — Service externalIPs: The externalIPs field in Service .spec is deprecated in Kubernetes 1.36. You will see deprecation warnings when creating or updating Services that use this field. Full removal is planned for Kubernetes 1.43. Customers who use externalIPs should migrate to LoadBalancer Services, NodePort, or Gateway API. For more information, see KEP-5707.

In-Place Pod Resource Updates (Stable): In-Place Pod Resource Updates allows users to adjust CPU and memory resources without restarting Pods or containers. Previously, such modifications required recreating Pods, which could disrupt workloads, particularly for stateful or batch applications. The new in-place functionality allows for smoother, non-disruptive vertical scaling, improves efficiency, and can also simplify development.

PreferSameNode Traffic Distribution (Stable): The trafficDistribution field for Services has been updated to provide more explicit control over traffic routing. A new option, PreferSameNode, has been introduced to allow services to strictly prioritize endpoints on the local node when available, falling back to remote endpoints otherwise. This change makes the API more explicit about preferring traffic within the current node.

StatefulSet MaxUnavailable (Beta): This feature enables parallel Pod updates by setting maxUnavailable (e.g., 3 or 10%), allowing stateful applications like database clusters to update up to 60% faster than sequential one-at-a-time updates, significantly reducing maintenance windows.

Windows Server 2025 Support: EKS 1.35 adds support for Windows Server 2025.

Kubelet Flag Removal: The --pod-infra-container-image flag has been removed from kubelet. Custom AMI users must remove this flag from kubelet configuration before upgrading to 1.35.

Deprecation Notice - IPVS Mode: IPVS mode in kube-proxy is deprecated and will be removed in Kubernetes 1.36.

Dynamic Resource Allocation (DRA) Core APIs (GA): Dynamic Resource Allocation has graduated to stable, enabling efficient management of specialized hardware like GPUs through standardized allocation interfaces - simplifying resource management for hardware accelerators and improving utilization of specialized resources.

Projected ServiceAccount Tokens for Kubelet (Beta): This enhancement improves security by using short-lived credentials for container image pulls instead of long-lived secrets - reducing the risk of credential exposure and strengthening the overall security posture of your clusters.

Pod-level Resource Requests and Limits (Beta): This feature simplifies resource management by allowing shared resource pools for multi-container pods - enabling more efficient resource allocation and utilization for complex applications with multiple containers.

Mutable CSI Node Allocatable Count (Beta): The MutableCSINodeAllocatableCount feature gate is enabled by default in EKS 1.34, making the CSINode max attachable volume count attribute mutable and introducing a mechanism to update it dynamically based on user configuration at the CSI driver level. These updates can be triggered either by periodic intervals or by failure detection, enhancing the reliability of stateful pod scheduling by addressing mismatches between reported and actual attachment capacity on nodes.

Deprecation Notice - cgroup driver configuration: Manual cgroup driver configuration is being deprecated in favor of automatic detection.

In-Place Pod Resource Resize (Beta): In-place resource resize has been promoted to beta, allowing dynamic updates to CPU and memory resources for existing Pods without restarts - enabling vertical scaling of stateful workloads with zero downtime and seamless resource adjustments based on traffic patterns.

Sidecar Containers Now Stable: Sidecar containers have graduated to stable, implementing sidecars as special init containers with restartPolicy: Always that start before application containers, run throughout the pod lifecycle, and support probes for operational state signaling.

Endpoints API Deprecation: The Endpoints API is now officially deprecated and will return warnings when accessed - migrate workloads and scripts to use the EndpointSlices API instead, which supports modern features like dual-stack networking and handles multiple EndpointSlices per Service.

Elastic Fabric Adapter Support: The default security group for Amazon EKS clusters now supports Elastic Fabric Adapter (EFA) traffic. The default security group has a new outbound rule that allows EFA traffic with the destination of the same security group. This allows EFA traffic within the cluster.