{
  "slug": "eksctl-nodegroup-config-supports-connectiontracking-timeouts-0df55eef1a7b",
  "title": "eksctl nodegroup config supports connectionTracking timeouts",
  "tools": [
    "eksctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-02T21:14:49.000Z",
  "announced_at": "2026-10-02T21:14:49.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For nodegroups running long-lived, mostly idle connections, set at least one timeout in `connectionTracking`; omitted fields retain EC2’s instance-type default. Configure it in the nodegroup config when creating the nodegroup.",
    "examples": [
      "apiVersion: eksctl.io/v1alpha5\nkind: ClusterConfig\nmetadata:\n  name: <cluster-name>\n  region: <region>\nmanagedNodeGroups:\n  - name: <nodegroup-name>\n    instanceType: <nitro-instance-type>\n    connectionTracking:\n      tcpEstablishedTimeout: 432000"
    ],
    "gotchas": [
      "Version: v0.231.0",
      "connectionTracking: Optional nodegroup block for connection tracking timeouts; if present, at least one timeout must be set.",
      "tcpEstablishedTimeout: Idle TCP established-connection timeout, in seconds; allowed range 60–432000.",
      "udpStreamTimeout: Idle UDP stream timeout, in seconds, for flows with more than one request-response transaction; allowed range 60–180.",
      "udpTimeout: Idle UDP timeout, in seconds, for flows with one direction of traffic or at most one request-response transaction; allowed range 30–60.",
      "Prerequisite: Every instance type the nodegroup can launch must be Nitro-based.",
      "Prerequisite: For pod interfaces to inherit the primary interface settings, VPC CNI must be v1.21.2 or v1.22.1, or later in those release lines; older versions apply the timeouts to node traffic only.",
      "At least one timeout must be set.",
      "Supported ranges are tcpEstablishedTimeout 60–432000 seconds, udpStreamTimeout 60–180 seconds, and udpTimeout 30–60 seconds.",
      "Timeouts left unset keep EC2's default for the instance type."
    ]
  },
  "why_it_matters": "Configure EC2 connection tracking timeouts for nodegroups that run workloads with long-lived, mostly idle connections.",
  "before": "The release note says this support lets users configure the timeouts in native nodegroup config without resorting to a hand-written launch template.",
  "sources": [
    "https://github.com/eksctl-io/eksctl/releases/tag/v0.231.0",
    "https://github.com/eksctl-io/eksctl/pull/8872",
    "https://eksctl.io/usage/nodegroup-connection-tracking/"
  ],
  "rank": 0.9603,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-99b1a15fa4b6a56c-0:gate",
    "evidence_hash": "e332263df2ddf1d8ddf3298909846e1aa9548e57737916a93b9b52556552c6cb"
  },
  "review": {
    "draft_hash": "b0ad66cf8f97b4255b3269ea60380b5d6ebc55aca52b133f19b5101727313a1e",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.73 (>= 0.6 needed)."
  }
}