# EKS Version Pin Worksheet

Track control plane, node, add-on, and **rollback deadline** for one cluster per copy.
**Rollback window:** 7 calendar days from in-place upgrade completion ([AWS docs](https://docs.aws.amazon.com/eks/latest/userguide/rollback-cluster.html)).

---

## Cluster identity

| Field | Value |
| --- | --- |
| Cluster name | |
| AWS account / region | |
| Environment (dev / staging / prod) | |
| Node mode (Auto Mode / MNG / self-managed / Fargate mix) | |
| Upgrade policy (`STANDARD` / `EXTENDED`) | |
| Change ticket / runbook link | |

---

## Version pins

| Component | Pre-upgrade (N-1) | Post-upgrade (N) | Target if rollback | Compatible? (Y/N) | Owner |
| --- | --- | --- | --- | --- | --- |
| Control plane | e.g. **1.35** | e.g. **1.36** | revert to **1.35** | | Platform |
| Managed node group(s) | | | must ≤ control plane | | Platform |
| Auto Mode NodePools | | | AWS-managed on rollback | | Platform |
| Self-managed kubelet/AMI | | | manual align before CP rollback | | Platform |
| VPC CNI add-on | | | | | Platform |
| CoreDNS add-on | | | | | Platform |
| kube-proxy add-on | | | | | Platform |
| EBS CSI / other CSI | | | | | Platform |
| AWS Load Balancer Controller (Helm) | | | | | Platform |
| Ingress / service mesh | | | | | App team |
| Custom admission webhooks | | | | | App team |

**Skew rule:** Worker kubelet cannot run **newer** than control plane. Roll back nodes (or delete Fargate pods) before control plane when versions match post-upgrade.

---

## Upgrade & rollback timeline

| Milestone | Timestamp (UTC) | Notes |
| --- | --- | --- |
| Staging upgrade completed | | |
| Production upgrade started | | |
| Production upgrade **completed** (ACTIVE) | | **Start 7-day rollback clock** |
| **Rollback deadline** (upgrade + 7 days) | | After this: rollback unavailable |
| Control-plane bake end (target +24–72h) | | Delay node recycle until bake done |
| Node alignment completed | | MNG/self-managed only |
| Rollback initiated (if needed) | | |
| Rollback completed (ACTIVE) | | |

### Quick deadline calculator

```
Rollback deadline = upgrade_completed_utc + 168 hours
Example: upgrade 2026-08-03 14:00 UTC → deadline 2026-08-10 14:00 UTC
```

---

## Rollback readiness insights (snapshot)

Refresh: console **Upgrade insights** tab or `aws eks start-insights-refresh`.

| Insight ID / name | Status (PASS/WARN/ERROR/UNKNOWN) | Blocking? | Resolution / `--force` rationale |
| --- | --- | --- | --- |
| | | | |
| | | | |
| | | | |

**Remember:** `--force` bypasses insight checks only — not the 7-day window, in-place requirement, N→N-1 limit, or Auto Mode PDB/disruption budgets.

---

## Extended Support cost note

If rollback target (N-1) is in **extended support**, set upgrade policy to **EXTENDED** before rollback.
All-in rate aligned with site benchmark: **$0.60/cluster-hour (~$438/month)** vs **$0.10/hour (~$73/month)** standard — see [EKS pricing post](/blog/amazon-eks-pricing-control-plane-addons-auto-mode/).

| Scenario | Control plane $/month (approx) |
| --- | --- |
| N on standard support | ~$73 |
| Rollback to N-1 in extended support | ~$438 until upgraded forward again |

---

## IaC pin sync (post-rollback or post-upgrade)

| Tool | Version pin location | Last applied | Matches live cluster? |
| --- | --- | --- | --- |
| Terraform `aws_eks_cluster` | | | |
| CloudFormation `AWS::EKS::Cluster` | | | |
| CDK / eksctl config | | | |
| GitOps cluster spec | | | |

**IaC timeouts vs rollback window:** CFN stack update timeout **36h**, Terraform apply **24h** default — plan manual CLI rollback if IaC job times out while cluster is still within 7-day EKS window.

---

## Sign-off

| Role | Bake approved (nodes OK to align)? | Rollback executed? | Signature / date |
| --- | --- | --- | --- |
| Platform lead | | | |
| App owner | | | |