Amazon EKS — Add-on Upgrades

EKS add-ons (VPC CNI, CoreDNS, kube-proxy, EBS CSI Driver) must be upgraded alongside the cluster. Mismatched versions can cause networking, DNS, or storage failures.

---

Check Current Versions

# List all add-ons
aws eks list-addons --cluster-name my-cluster

# Check each add-on version
for addon in vpc-cni coredns kube-proxy aws-ebs-csi-driver; do
  echo "$addon: $(aws eks describe-addon --cluster-name my-cluster --addon-name $addon --query 'addon.addonVersion' --output text 2>/dev/null)"
done

---

Version Compatibility

# Find compatible versions for your K8s version
aws eks describe-addon-versions \
  --kubernetes-version 1.30 \
  --addon-name vpc-cni \
  --query 'addons[0].addonVersions[*].{Version:addonVersion,Default:compatibilities[0].defaultVersion}' \
  --output table

---

Upgrade Add-ons

VPC CNI

aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name vpc-cni \
  --addon-version v1.18.1-eksbuild.1 \
  --resolve-conflicts OVERWRITE

CoreDNS

aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name coredns \
  --addon-version v1.11.1-eksbuild.9 \
  --resolve-conflicts OVERWRITE

kube-proxy

aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name kube-proxy \
  --addon-version v1.30.0-eksbuild.3 \
  --resolve-conflicts OVERWRITE

EBS CSI Driver

aws eks update-addon \
  --cluster-name my-cluster \
  --addon-name aws-ebs-csi-driver \
  --addon-version v1.31.0-eksbuild.1 \
  --resolve-conflicts OVERWRITE

---

Resolve Conflicts

Strategy	Behavior
NONE	Fail if any custom configuration exists
OVERWRITE	AWS overwrites your custom config with defaults
PRESERVE	Keep your custom config, only update the binary

Use PRESERVE if you’ve customized add-on settings (e.g., VPC CNI environment variables). Use OVERWRITE for fresh installs.

---

Upgrade Order

Order	Add-on	Why
1	kube-proxy	Network proxy must match control plane version first
2	VPC CNI	Networking plugin — pods need IPs
3	CoreDNS	DNS resolution for services
4	EBS CSI Driver	Storage — can lag slightly without immediate impact
5	Other add-ons	ADOT, Pod Identity Agent, etc.

---

eksctl Upgrade

# Update all add-ons at once
eksctl utils update-aws-node --cluster my-cluster --approve
eksctl utils update-coredns --cluster my-cluster --approve
eksctl utils update-kube-proxy --cluster my-cluster --approve

---

Terraform

resource "aws_eks_addon" "vpc_cni" {
  cluster_name                = module.eks.cluster_name
  addon_name                  = "vpc-cni"
  addon_version               = "v1.18.1-eksbuild.1"
  resolve_conflicts_on_update = "PRESERVE"
  service_account_role_arn    = module.vpc_cni_irsa.iam_role_arn
}

resource "aws_eks_addon" "coredns" {
  cluster_name                = module.eks.cluster_name
  addon_name                  = "coredns"
  addon_version               = "v1.11.1-eksbuild.9"
  resolve_conflicts_on_update = "OVERWRITE"
}

resource "aws_eks_addon" "kube_proxy" {
  cluster_name                = module.eks.cluster_name
  addon_name                  = "kube-proxy"
  addon_version               = "v1.30.0-eksbuild.3"
  resolve_conflicts_on_update = "OVERWRITE"
}

---

Self-Managed Add-on Upgrades

For add-ons installed via Helm (not EKS managed):

# AWS Load Balancer Controller
helm upgrade aws-load-balancer-controller eks/aws-load-balancer-controller \
  --namespace kube-system \
  --set clusterName=my-cluster \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller

# Karpenter
helm upgrade karpenter oci://public.ecr.aws/karpenter/karpenter \
  --version "1.0.0" \
  --namespace kube-system \
  --reuse-values

---

Verify After Upgrade

# Check add-on health
aws eks describe-addon --cluster-name my-cluster --addon-name vpc-cni --query 'addon.{Status:status,Version:addonVersion}'

# Check pod health
kubectl get pods -n kube-system

# Test DNS resolution
kubectl run dns-test --image=busybox:latest --restart=Never --rm -it -- nslookup kubernetes.default

# Test networking
kubectl run net-test --image=busybox:latest --restart=Never --rm -it -- wget -qO- http://kubernetes.default/healthz

---

Best Practices

1. Upgrade add-ons immediately after control plane — don’t leave them on old versions
2. Use PRESERVE for customized add-ons — avoid losing custom VPC CNI config
3. Check version compatibility before upgrading — not all add-on versions work with all K8s versions
4. Verify DNS and networking after VPC CNI and CoreDNS upgrades
5. Automate with Terraform — track versions in code, apply with terraform apply

---