By Zesty Team

Read More >

In June 2025, Kubernetes services across AWS, Azure, and Google Cloud saw major enhancements in security, AI‑assisted development workflows, quota enforcement, node autoscaling behavior, and observability metrics. These updates reinforce cloud-native management, operational automation, and security monitoring for EKS, AKS, and GKE environments.

AWS EKS

• GuardDuty Extended Threat Detection adds Amazon EKS support

Amazon GuardDuty Extended Threat Detection now supports Amazon EKS clusters, enabling detection of multi-stage attack sequences by correlating Kubernetes audit logs, container runtime behavior, malware execution, and AWS API activity.

•  Launch of Amazon EKS Model Context Protocol (MCP) Server 

AWS released the open-source Model Context Protocol (MCP) Server for EKS, allowing AI assistants to access real-time cluster metadata, best practices, and feature-aware guidance—designed to accelerate Kubernetes application development workflows.
Source: AWS Containers Blog and Weekly Roundup (June 2025)

Azure AKS

• AKS retires Ubuntu 18.04 node image support

As of June 17, 2025, AKS no longer supports provisioning or scaling node pools using Ubuntu 18.04, and will no longer issue security updates or new images for that OS. Existing nodes remain unsupported and unscalable.

• Improved observability and cost-control documentation

On June 17, 2025, Microsoft updated AKS documentation to include a CIS Benchmark compliance guide, container network observability using Cilium (L3–L7), and a comprehensive cost‑analysis guide for optimizing AKS workloads.

Google Cloud GKE

• Sidecar container metrics now exposed 

As of June 10, 2025, GKE began reporting CPU and memory requests and limit metrics for Kubernetes-native sidecar containers, starting with GKE version 1.32.4‑gke.1106006.

• Cluster Autoscaler can evict kube-system Pods for scale-down 

From June 16, 2025, in GKE version 1.32.4‑gke.1236000 or later, the Cluster Autoscaler can scale down nodes by evicting Pods in the kube-system namespace that do not have a Pod Disruption Budget and have been running for at least one hour.