Are all Bottlerocket AMI releases mandatory to upgrade?

[Madhav5843]

Hi team,

I’ve noticed that Bottlerocket AMIs have frequent releases, including pre-releases, minor updates, and major updates. I’m wondering if it’s necessary to upgrade to every new release, or if there’s a best practice for deciding which versions are mandatory to adopt.

Specifically:
1. Are there certain releases we should prioritize for security or stability?
2. Should pre-releases be avoided in production environments?
3. What’s the recommended strategy for balancing stability with staying up to date?

[Sparksssj]

Thank you for your valuable question. These are answer from @yeazelm:

1 . Are there certain releases we should prioritize for security or stability?

We do have an open issue to document this and we should still do this but to answer your question here: Bottlerocket does follow SemVer when it relates the the API in settings. Where Major.minor.patch is the versioning, Major going from 1 to something else would indicate that there is a breaking change in the settings API. We have not done this so far and have no current plans to so that leaves minor and patch releases. We aim to signal there are features or changes that might prompt a review of the CHANGELOG for a minor release vs patch releases which mostly consist of security fixes, bug fixes, or minor/non-functional changes like updating transitive code dependencies. Our intention here is to signal that patch releases have the least amount of change and are aimed at providing timely fixes with minimal delay. Nonetheless, all our releases go through the same pre-release validation and are published in all locations at the same time. We will include security fixes and bugfixes in minor releases as well, but there may also be features that you may want to look at.

2. Should pre-releases be avoided in production environments?

Our intention with pre-releases is to signal that the release has passed our testing. This means AMIs, images, and in-place updates are available everywhere, but the latest SSM parameters may not point to this release everywhere yet. We mark the release as latest when we have finished this rollout of latest. We recommend that you always validate a Bottlerocket release, regardless of “pre-release” status or not before using it in your production environment. Bottlerocket only releases images that we believe are ready for production, but due to the vast differences in environments, we recommend you validate the release is suitable for your specific environment.

3. What’s the recommended strategy for balancing stability with staying up to date?

We don’t have a one-size-fits-all strategy for staying up to date but the most general approach would be to automate the validation of each release in a testing environment before promoting to production. The idea would be to take updates in testing as fast as possible, and once a threshold has been passed for validation (time based, specific tests, or whatever seems to match your promotion criteria best), then promote to production. Each use case may differ and you should adjust to the specific considerations for your environment.