runtimezUpgrade readiness report · RTZ-2026-1018-0310rtz-eks can move to EKS 1.35: nothing blocks the hop
A read-only scan of one cluster: what changes on the way from 1.34 to 1.35, how to check each item yourself, and what waiting costs.
The scan raised 57 findings across Kubernetes and 7 add-ons. Checked against the cluster, none blocks the 1.34 → 1.35 hop. One HIGH item must be handled before the VPC CNI's own next upgrade, and one node setting is worth a one-line check. Upgrading before Dec 2 keeps this cluster on standard pricing.
1. Deadlines on this cluster
| What | Date | Days left | What happens |
|---|---|---|---|
| EKS 1.34 standard support ends | 2026-12-02 | 45 | Billing moves from $0.10 to $0.60 per cluster-hour: about $365 more a month for this cluster. |
| EKS 1.35 standard support ends | 2027-03-27 | 160 | The next deadline once you are on 1.35. Plan the 1.36 hop, and a newer Istio, before it. |
| EKS 1.34 extended support ends | 2027-12-02 | 410 | If the cluster is still on 1.34, AWS upgrades the control plane to 1.35 itself. Nodes and add-ons stay where they are. |
Dates from the Amazon EKS release calendar. Prices from AWS EKS pricing: $0.10 per cluster-hour standard, $0.60 extended, 730 hours a month. Work out your own fleet →
2. Before upgrading
Each item names what was found, quotes the vendor's own words, and gives a command so you can confirm it without trusting us.
rtz-aws-vpc-cni-1.23-network-policy-agent-v1-4-1-required1. Network policy will break if the VPC CNI is moved to v1.23 without its agent and probes
kube-system/aws-node: VPC CNI v1.22.4 (Helm chart aws-vpc-cni 1.22.4)- Network Policy Agent
v1.4.0-eksbuild.1, with network policy enforced (--enable-network-policy=true, NETWORK_POLICY_ENFORCING_MODE=standard, 2 NetworkPolicies) - aws-node liveness probe still on
-addr=:50051
This release must be run with Network Policy AgentAmazon VPC CNI v1.23 release notesv1.4.1. #3739 moves the IPAMD gRPC server from a TCP port to a Unix domain socket, so the Network Policy Agent must be onv1.4.1to connect over the socket.
Not part of the Kubernetes 1.35 hop: the CNI's own next upgrade. Done image-only, an agent below v1.4.1 waits forever on ipamd's old TCP port, so new pods fail with failed to setup network policy, and the old probe hits a port nothing listens on, so aws-node never goes Ready.
kubectl -n kube-system get ds aws-node -o json | jq -r '.spec.template.spec.containers[] | "\(.name): \(.image)"'Move to v1.23 with the v1.23 chart (or EKS add-on) as a whole: it raises the agent to v1.4.1+ and switches the probes to -addr=unix:///var/run/aws-node/ipamd.sock together.
rtz-k8s-kubelet-fail-cgroup-v1-disabled2. All 4 nodes set failCgroupV1=false, which switches off the 1.35 cgroup v1 safety check
- 4 of 4 nodes, all Amazon Linux 2023
ACTION REQUIRED: failCgroupV1 will be set to true from 1.35. This means that nodes will not start on a cgroup v1 by default.Kubernetes 1.35 release notesThe override only changes anything on a cgroup v1 host. Amazon Linux 2023 uses cgroup v2, so it should have no effect here. Confirm before the hop.
stat -fc %T /sys/fs/cgroup # on each node: cgroup2fs = cgroup v2Nothing to change if every node prints cgroup2fs.
3. The hop and the add-ons
EKS moves one minor version at a time: control plane first, then nodes, then add-ons.
| Hop | Before and after | Found |
|---|---|---|
| 1.34 → 1.35 | Before: confirm every node prints cgroup2fs (item 2). After the control plane: update kube-proxy to its 1.35 build, then roll the nodes to 1.35 before any further control-plane hop. | 0 blocking 1 confirm |
| Add-on | Installed | Supports 1.35? |
|---|---|---|
| Istio | 1.29.1 | Yes Vendor matrix covers Kubernetes 1.31–1.35. 1.36 will need a newer Istio. |
| Karpenter | 1.14.1 | Yes Vendor matrix covers Kubernetes 1.26–1.36. |
| kube-proxy | v1.34.6-eksbuild.29 | Yes Within the version-skew window (1.34–1.37 control planes). Update to the 1.35 build after the hop. |
| Amazon EBS CSI driver | v1.66.0 | No vendor matrix No Kubernetes compatibility table published. Serves the cluster's volumes, including the legacy gp2 class (section 4). |
| Amazon VPC CNI | v1.22.4-eksbuild.3 | No vendor matrix No Kubernetes compatibility table published. Its own v1.23 upgrade needs care: item 1. |
| CoreDNS | v1.12.4-eksbuild.38 | No vendor matrix No Kubernetes compatibility table published. 22 release-note changes on the way to 1.14.7 (section 5). |
| Traefik | v3.6.25 | No vendor matrix No Kubernetes compatibility table published. 15 release-note changes on the way to 3.7.14 (section 5). |
4. Can wait until after the upgrade
| Severity | Item | Objects |
|---|---|---|
| Low | StorageClass gp2 uses the in-tree volume plugin "awsElasticBlockStore", which Kubernetes serves through the ebs.csi.aws.com CSI driver. Nothing is broken: CSI migration serves it. Move it to ebs.csi.aws.com directly, or delete it, when convenient. | storageclass/gp2 |
| Low | 6 Istio admission webhooks use failurePolicy: Fail: while istiod restarts during the node roll, the requests they match are refused. Keep istiod at two or more replicas with a PodDisruptionBudget. | istio-system/istiod |
5. Release-note changes to review by hand
These depend on configuration no cluster scan can see. Each matters only if the condition on the right is true.
| Change, in the vendor's words | Matters if |
|---|---|
| DRA partitionable devices (alpha) changed incompatibly — ResourceSlices using counter sets must be removed before the upgrade This change introduced backwards-incompatible updates to the alpha feature, requiring any ResourceSlices using it to be removed before upgrading or downgrading between v1.34 and v1.35. | You use the alpha DRA partitionable-devices feature. |
| Components refuse to start when an enabled feature gate depends on a disabled one (AllAlpha=true now needs AllBeta=true) A feature can no longer be enabled if it depends on a disabled feature. In particular, this means that AllAlpha=true will no longer work without enabling disabled-by-default beta features that are depended on | Your node bootstrap enables feature gates, especially AllAlpha. |
| Kubelets now re-authenticate private images per pod — IfNotPresent no longer shares a credentialed image, and imagePullPolicy: Never can fail The KubeletEnsureSecretPulledImages feature was promoted to Beta and enabled by default. | Pods use private images with imagePullPolicy: Never or rely on another pod's pull credentials. |
| status.nominatedNodeName is now set for every pod the scheduler is about to bind, and cleared after binding Enabled the NominatedNodeNameForExpectation feature in kube-scheduler by default. | Tooling reads status.nominatedNodeName. |
| In-place pod resize rejects changes to resources other than cpu and memory Pod resize now only allows CPU and memory resources; other resource types are forbidden. | Workloads resize pods in place on resources other than CPU and memory. |
| SageMaker HyperPod nodes: the CNI now attaches ENIs through the SageMaker API (v1.23.2) Use the sagemaker:AttachClusterNodeNetworkInterface API for HyperPod nodes | Only on SageMaker HyperPod nodes, after the VPC CNI moves to v1.23.2. |
CoreDNS v1.12.4 → 1.14.7: 22 changes. Read before moving CoreDNS; each comes with a check against your Corefile.
- auto: zone-file regex length is limited
- forward: new opt-in
failover RCODE…option (1.13.0) — no behaviour change by itself - forward: a failover option listing NOERROR is rejected — CoreDNS does not start
- geoip: missing latitude/longitude will stop being reported as 0
- grpc: DNS message size limits are enforced
- multisocket: the number of sockets is capped
- sign: invalid UTF-8 in the dbfile is rejected
- autopath now runs before acl (1.14.7)
- azure: the access mode applies to every zone in the block
- DoH: oversized GET dns parameters are rejected
- forward: default connect attempts are capped
- dnstap: FORWARDER_* messages now describe the CoreDNS-to-upstream socket
- TLS max version and cipher list are now Go's defaults (the TLS 1.2 minimum stays)
- hosts: a
*owner name is a wildcard from 1.14.5 — existing entries change meaning - kubernetes: API server calls are rate-limited
- local: every name under .localhost. is answered locally (1.14.5); the localhost.<domain> prefix form is deprecated
- The image pins a numeric uid/gid for its nonroot user
- proxyproto: an explicit default policy applies even without an allow list
- Regexes in the Corefile are length-limited
- rewrite now runs before acl
- TSIG is fully verified on DoH, DoH3, DoQ and gRPC transports
- any/local/chaos/health/log/ready/trace/dnstap: unknown block options are rejected
Traefik 3.6 → 3.7.14: 15 changes. Read before moving Traefik; each comes with a check against your routes.
- A default TLSOption or TLSStore in any namespace is cluster-wide
- CRDs must be updated for the new retry options and ingressClassName
- Gateway API provider moves to spec v1.5.1
- Gateway API v1.6.1 Standard CRDs stop serving TCPRoute v1alpha2 — the Gateway provider never starts
- Gateway API: of two routes that match equally well, only the one with precedence serves
- Gateway API: TLSRoute router and service names change
- Upgrade: h2c and HTTP2-Settings request headers are no longer forwarded to backends
- Ingress NGINX provider needs a configmaps RBAC grant
- Ingress-NGINX provider keeps dots in generated router and service names
- OpenTelemetry request-duration histograms follow the exponential-aggregation environment variable
- Requests with a rootless target (http:example.com/admin) are rejected with 400
- safeNaming changes generated router, middleware and service names
- New core.strictTLSOptions option can turn the silent default-TLS fallback into disabled routers
- A route's TLSOption now applies to its wildcard Host
- A weighted service with an unbuildable child now reports disabled
6. What this scan could not check
A green result only means something if you know what was not looked at. This scan did not cover:
Control-plane flags. AWS runs the EKS control plane, so kube-apiserver, controller-manager and scheduler flags cannot be read, and the four rules about them (control-plane version skew, and the 1.35 request-header CA check) do not apply. AWS sets these for each EKS version.
Old Gateway API calls. The API server counted requests for gateway.networking.k8s.io/v1alpha2 tcproutes, gateway.networking.k8s.io/v1alpha2 tlsroutes, a version discovery no longer describes. On review the Gateway API CRDs are not installed, no such routes exist and Traefik's Gateway provider is off, so these are most likely left over from an earlier install. The counter resets when the API server restarts.
Node host settings. The cgroup version and kubelet command-line flags live on the hosts. Item 2's command checks the one that matters for this hop.
The 43 changes in section 5. Each needs a person who knows how the cluster is configured.
How this report was made. kube-upgrade-check 0.1.7 read the cluster with the operator's kubeconfig, read-only, on 2026-10-18 at 03:10 UTC, and raised 57 findings. Each was then checked against the cluster by hand (the aws-node DaemonSet and network-policy settings, Gateway API CRDs, Traefik's providers, StorageClasses and PersistentVolumes, node OS images). Severities are the tool's own. Support dates are from the Amazon EKS calendar, not the CLI's rounded dates. Nothing was changed in the cluster.
Next step. Run the same checks continuously across all your clusters at runtimez.io, or book a 30-minute walkthrough at calendly.com/silpa-runtimez/30min.