Post-upgrade tasks for the April 2026 release
Perform the following tasks after your organization is upgraded to the April 2026 release.
Advanced clusters on AWS
The April 2026 release upgrades advanced clusters on AWS to use Kubernetes 1.34. If you use custom master and worker roles, update the policies.
For the master role, update minimal_master_policy to the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:DescribeAvailabilityZones", // April 2026 release requirement
"ec2:DescribeSnapshots", // April 2026 release requirement
"ec2:DescribeTags" // April 2026 release requirement
],
"Resource": [""]
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DescribeVolumesModifications",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyVolume"
],
"Resource": [""]
},
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume", // If enabling CLAIRE, move AttachVolume to the same section as CreateVolume.
"ec2:DeleteVolume",
"ec2:DetachVolume"
],
"Resource": [""],
"Condition": {
"StringLike": {
"ec2:ResourceTag/KubernetesCluster": ".k8s.local"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot", // April 2026 release requirement
"ec2:DeleteSnapshot" // April 2026 release requirement
],
"Resource": [""]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeAutoScalingInstances",
"autoscaling:DescribeTags",
"autoscaling:DescribeScalingActivities"
],
"Resource": [""]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:SetDesiredCapacity",
"autoscaling:TerminateInstanceInAutoScalingGroup",
"autoscaling:UpdateAutoScalingGroup"
],
"Resource": [""],
"Condition": {
"StringLike": {
"autoscaling:ResourceTag/KubernetesCluster": ".k8s.local"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:AttachLoadBalancerToSubnets",
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
"elasticloadbalancing:ConfigureHealthCheck",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancerListeners",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DetachLoadBalancerFromSubnets",
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer"
],
"Resource": [""],
"Condition": {
"StringLike": {
"elasticloadbalancing:ResourceTag/KubernetesCluster": ".k8s.local"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
],
"Resource": [""],
"Condition": {
"StringLike": {
"elasticloadbalancing:ResourceTag/KubernetesCluster": ".k8s.local"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:ListServerCertificates",
"iam:GetServerCertificate"
],
"Resource": [""]
},
{
"Effect": "Allow",
"Action": [
"s3:Get*"
],
"Resource": [
"arn:aws:s3:::<cluster-staging-dir1>/"
]
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": ["*"]
}
]
}
For the worker role, update minimal_worker_policy to the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeRegions",
"ec2:CreateVolume", // April 2026 release requirement
"ec2:AttachVolume", // April 2026 release requirement
"ec2:DeleteVolume", // April 2026 release requirement
"ec2:DetachVolume", // April 2026 release requirement
"ec2:ModifyVolume", // April 2026 release requirement
"ec2:DescribeAvailabilityZones", // April 2026 release requirement
"ec2:DescribeSnapshots", // April 2026 release requirement
"ec2:DescribeTags", // April 2026 release requirement
"ec2:DescribeVolumes", // April 2026 release requirement
"ec2:DescribeVolumesModifications", // April 2026 release requirement
"ec2:CreateSnapshot", // April 2026 release requirement
"ec2:DeleteSnapshot" // April 2026 release requirement
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*"
]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingInstances",
"autoscaling:DescribeTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:Get*"
],
"Resource": [
"arn:aws:s3:::<cluster-staging-dir1>/*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": [
"*"
]
}
]
}