# Images As of Kubernetes 1.27 the default images used by kOps are the **[official Ubuntu 22.04](#ubuntu-2204-jammy)** images. You can choose a different image for an instance group by editing it with `kops edit ig nodes`. For AWS, you should set the `image` field in one of the following formats: * `ami-abcdef` - specifies an image by id directly (image id is precise, but ids vary by region) * `/` specifies an image by its owner's account ID and name properties * `/` specifies an image by its [owner's alias](#owner-aliases) and name properties * `ssm:` specifies an image through an SSM parameter (kOps 1.25.3+) ```yaml image: ami-00579fbb15b954340 image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200423 image: ubuntu/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200423 image: ssm:/aws/service/canonical/ubuntu/server/20.04/stable/current/amd64/hvm/ebs-gp2/ami-id ``` ## Security Updates Automated security updates are handled by kOps for Debian, Flatcar and Ubuntu distros. This can be disabled by editing the cluster configuration: ```yaml spec: updatePolicy: external ``` ## Distros Support Matrix The following table provides the support status for various distros with regards to kOps version: | Distro | Experimental | Stable | Deprecated | Removed | |-----------------------------------------|-------------:|-------:|-----------:|--------:| | [Amazon Linux 2](#amazon-linux-2) | 1.10 | 1.18 | - | - | | [Amazon Linux 2023](#amazon-linux-2023) | 1.27 | - | - | - | | CentOS 7 | - | 1.5 | 1.21 | 1.23 | | CentOS 8 | 1.15 | - | 1.21 | 1.23 | | CoreOS | 1.6 | 1.9 | 1.17 | 1.18 | | Debian 8 | - | 1.5 | 1.17 | 1.18 | | Debian 9 | 1.8 | 1.10 | 1.21 | 1.23 | | [Debian 10](#debian-10-buster) | 1.13 | 1.17 | - | - | | [Debian 11](#debian-11-bullseye) | 1.21.1 | - | - | - | | [Debian 12](#debian-12-bookworm) | 1.26.3 | - | - | - | | [Flatcar](#flatcar) | 1.15.1 | 1.17 | - | - | | Kope.io | - | - | 1.18 | 1.23 | | RHEL 7 | - | 1.5 | 1.21 | 1.23 | | [RHEL 8](#rhel-8) | 1.15 | 1.18 | - | - | | [RHEL 9](#rhel-9) | 1.27 | - | - | - | | [Rocky 8](#rocky-8) | 1.23.2 | 1.24 | - | - | | [Rocky 9](#rocky-9) | 1.30 | - | - | - | | Ubuntu 16.04 | 1.5 | 1.10 | 1.17 | 1.20 | | Ubuntu 18.04 | 1.10 | 1.16 | 1.26 | 1.28 | | [Ubuntu 20.04](#ubuntu-2004-focal) | 1.16.2 | 1.18 | - | - | | [Ubuntu 22.04](#ubuntu-2204-jammy) | 1.23 | 1.24 | - | - | | [Ubuntu 24.04](#ubuntu-2404-noble) | 1.29 | - | - | - | ## Supported Distros ### Amazon Linux 2 Amazon Linux 2 has variants using Kernel versions 4.14 and 5.10. Be sure to use the 5.10 images as specified in the image filter below. More information is available in the [AWS Documentation](https://aws.amazon.com/amazon-linux-2/faqs/). For kOps versions 1.16 and 1.17, the only supported Docker version is `18.06.3`. Newer versions of Docker cannot be installed due to missing dependencies for `container-selinux`. This issue is fixed in kOps **1.18**. Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --filters "Name=owner-alias,Values=amazon" \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=amzn2-ami-kernel-5.10-hvm-2*-*-gp2" ``` ### Amazon Linux 2023 Amazon Linux 2023 uses Kernel version 6.1. More information is available in the [AWS Documentation](https://aws.amazon.com/linux/amazon-linux-2023/faqs/). Only the standard AMI is supported, the [minimal AMI](https://docs.aws.amazon.com/linux/al2023/ug/AMI-minimal-and-standard-differences.html) is not supported. Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --filters "Name=owner-alias,Values=amazon" \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=al2023-ami-2*-kernel-6.1-*" ``` ### Debian 10 (Buster) Debian 10 is based on Kernel version **4.19** which fixes some of the bugs present in Debian 9 and effects are less visible. One notable change is the addition of `iptables` NFT, which is by default. This is not yet supported by most CNI plugins and seems to be [slower](https://youtu.be/KHMnC3kj3Js?t=771) than the legacy version. It is recommended to switch to `iptables` legacy by using the following script in `additionalUserData` for each instance group: ```yaml additionalUserData: - name: busterfix.sh type: text/x-shellscript content: | #!/bin/sh update-alternatives --set iptables /usr/sbin/iptables-legacy update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy update-alternatives --set arptables /usr/sbin/arptables-legacy update-alternatives --set ebtables /usr/sbin/ebtables-legacy ``` Available images can be listed using: ```bash # Amazon Web Services (AWS) aws ec2 describe-images --region us-east-1 --output table \ --owners 136693071363 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=debian-10-*-*" # Google Cloud Platform (GCP) gcloud compute images list --filter debian-10-buster-v # Microsoft Azure az vm image list --all --output table \ --publisher Debian --offer debian-10 --sku 10-gen2 ``` ### Debian 11 (Bullseye) Debian 11 is based on Kernel version **5.10** which has no known major Kernel bugs and fully supports all Cilium features. Available images can be listed using: ```bash # Amazon Web Services (AWS) aws ec2 describe-images --region us-east-1 --output table \ --owners 136693071363 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=debian-11-*-*" # Google Cloud Platform (GCP) gcloud compute images list --filter debian-11-bullseye-v # Microsoft Azure az vm image list --all --output table \ --publisher Debian --offer debian-11 --sku 11-gen2 ``` ### Debian 12 (Bookworm) Debian 12 is based on Kernel version **6.1** which has no known major Kernel bugs and fully supports all Cilium features. Available images can be listed using: ```bash # Amazon Web Services (AWS) aws ec2 describe-images --region us-east-1 --output table \ --owners 136693071363 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=debian-12-*-*" ``` ### Flatcar Flatcar is a friendly fork of CoreOS and as such, compatible with it. Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --owners 075585003325 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=Flatcar-stable-*-hvm" ``` ### RHEL 8 RHEL 8 is based on Kernel version **4.18** which fixes some of the bugs present in RHEL/CentOS 7 and effects are less visible. One notable change is the addition of `iptables` NFT, which is the only iptables backend available. This may not be supported by some CNI plugins and should be used with care. Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --owners 309956199498 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=RHEL-8.*" ``` ### RHEL 9 RHEL 9 is based on Kernel version **5.15** which fixes all the known major Kernel bugs. Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --owners 309956199498 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=RHEL-9.*" ``` ### Rocky 8 Rocky Linux is a community enterprise Operating System designed to be 100% bug-for-bug compatible with [RHEL 8](#rhel-8). Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --owners 792107900819 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=Rocky-8-ec2-8.*.*" ``` ### Rocky 9 Rocky Linux 9 is based on Kernel version **5.14**. Available images can be listed using: ```bash aws ec2 describe-images --region us-east-1 --output table \ --owners 792107900819 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=Rocky-9-EC2-Base-9.*.*" ``` ### Ubuntu 20.04 (Focal) Ubuntu 20.04 is based on Kernel version **5.4** which fixes all the known major Kernel bugs. Available images can be listed using: ```bash # Amazon Web Services (AWS) aws ec2 describe-images --region us-east-1 --output table \ --owners 099720109477 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-focal-20.04-*-*" # Google Cloud Platform (GCP) gcloud compute images list --filter ubuntu-2004-focal-v # Microsoft Azure az vm image list --all --output table \ --publisher Canonical --offer 0001-com-ubuntu-server-focal --sku 20_04-lts-gen2 ``` ### Ubuntu 22.04 (Jammy) Ubuntu 22.04 is based on Kernel version **5.15** which fixes all the known major Kernel bugs. Available images can be listed using: ```bash # Amazon Web Services (AWS) aws ec2 describe-images --region us-east-1 --output table \ --owners 099720109477 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-*-*" # Google Cloud Platform (GCP) gcloud compute images list --filter ubuntu-2204-jammy-v # Microsoft Azure az vm image list --all --output table \ --publisher Canonical --offer 0001-com-ubuntu-server-jammy --sku 22_04-lts-gen2 ``` ### Ubuntu 24.04 (Noble) Support for Ubuntu 24.04 is **experimental**. ```bash # Amazon Web Services (AWS) aws ec2 describe-images --region us-east-1 --output table \ --owners 099720109477 \ --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \ --filters "Name=name,Values=ubuntu/images/hvm-ssd-gp3/ubuntu-jammy-22.04-*-*" ``` ## Owner aliases kOps supports owner aliases for the official accounts of supported distros: * `amazon` => `137112412989` * `debian10` => `136693071363` * `debian11` => `136693071363` * `flatcar` => `075585003325` * `redhat` => `309956199498` * `ubuntu` => `099720109477`