github.com/aws/amazon-vpc-cni-k8s

What's Changed

• chore: deps bump for CVE fix by @viveksb007 in #3689
• chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 by @nakshah87 in #3687
• Add ec2:DescribeSecurityGroups to IAM policy by @johanneswuerbach in #3709
• Add prerouting connmark rules through nftable instead of iptables. by @yash97 in #3588
• Mixed os snat weekly cron by @yash97 in #3707
• pkg/ipamd: fix dropped test error by @alrs in #3622
• Fix unmanaged eni by @jaydeokar in #3660
• Latest nginx by @Issacwww in #3733
• chore: update VPC IP resource limits by @github-actions[bot] in #3673
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #3718
• build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 by @dependabot[bot] in #3715
• build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent by @dependabot[bot] in #3714
• build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #3679
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #3701
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #3700
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 by @dependabot[bot] in #3641
• chore: cleanup dead code from esgd revert by @cdirubbio in #3728
• test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup by @yash97 in #3742
• build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 by @dependabot[bot] in #3750
• build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in #3751
• build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent by @dependabot[bot] in #3749
• fix: resolve ci account vpc leaking during ITs by @cdirubbio in #3755
• tests: update eksctl for CI to not use default addon PDBs by @cdirubbio in #3757
• Move gRPC server to Unix socket and scrub introspection data by @oliviassss in #3739
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3760
• build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3761
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #3745
• Group github action dependency updates together by @jaydeokar in #3766
• build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in #3771
• test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak by @yash97 in #3773
• test: fix custom-networking BeforeSuite ASG scale-to-0 wait by @yash97 in #3775
• Fix misleading duration format in DAD-wait timeout error message by @viveksb007 in #3776
• build(deps): bump the other-deps group with 2 updates by @dependabot[bot] in #3772
• build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #3648
• build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent by @dependabot[bot] in #3767
• build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in #3769
• build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 by @dependabot[bot] in #3770
• chore: update VPC IP resource limits by @jaydeokar in #3778
• build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory by @dependabot[bot] in #3768
• build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory by @dependabot[bot] in #3748
• build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group by @dependabot[bot] in #3783
• build(deps): bump the other-deps group with 3 updates by @dependabot[bot] in #3784
• test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) by @yash97 in #3786
• test: fix custom-networking/SGPP integration failures and teardown VPC leak by @yash97 in #3787
• chore: update VPC IP resource limits by @github-actions[bot] in #3790
• Create the host-side veth directly in the host namespace via the netlink PeerNamespace attribute by @amrmahdi in #3764
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the other-deps group by @dependabot[bot] in #3795
• test: replace fixed sleeps with readiness polls in pod-eni and eni-subnet-discovery suites by @yash97 in #3797
• Changelog, chart, and manifest updates for v1.23.0 release by @yash97 in #3792
• sync release 1.23 with master by @yash97 in #3791
• test: bump kops node image to Ubuntu 22.04 to fix containerd glibc mismatch by @yash97 in #3789
• test: increase cni integration suite timeout to 120m by @yash97 in #3806
• Sync release 1.23 with master by @yash97 in #3807
• cve fix by @yash97 in #3808
• (bug) Return error if the parsing fails and UT by @jaydeokar in #3802
• test: fix flaky ENI-placement precondition in cni integration suite by @yash97 in #3810
• Sync release-1.23 with master by @yash97 in #3813

New Contributors

• @johanneswuerbach made their first contribution in #3709
• @amrmahdi made their first contribution in #3764

Full Changelog: v1.22.4...v1.23.0

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.23.0/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.23.0/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.23.0
amazon-k8s-cni:v1.23.0
amazon/aws-network-policy-agent:v1.4.1

[!WARNING] This release must be run with Network Policy Agent v1.4.1. #3739 moves the IPAMD gRPC server from a TCP port to a Unix domain socket, so the Network Policy Agent must be on v1.4.1 to connect over the socket.

• chore: deps bump for CVE fix by @viveksb007 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3689
• chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 by @nakshah87 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3687
• Adding CNI v1.21.2 release by @haouc in https://github.com/aws/amazon-vpc-cni-k8s/pull/3690
• Add ec2:DescribeSecurityGroups to IAM policy by @johanneswuerbach in https://github.com/aws/amazon-vpc-cni-k8s/pull/3709
• Add prerouting connmark rules through nftable instead of iptables. by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3588
• Mixed os snat weekly cron by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3707
• pkg/ipamd: fix dropped test error by @alrs in https://github.com/aws/amazon-vpc-cni-k8s/pull/3622
• Fix unmanaged eni by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3660
• Latest nginx by @Issacwww in https://github.com/aws/amazon-vpc-cni-k8s/pull/3733
• chore: update VPC IP resource limits by @github-actions[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3673
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3718
• build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3715
• build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3714
• build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3679
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3701
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3700
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3641
• chore: cleanup dead code from esgd revert by @cdirubbio in https://github.com/aws/amazon-vpc-cni-k8s/pull/3728
• test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3742
• build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3750
• build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3751
• build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3749
• fix: resolve ci account vpc leaking during ITs by @cdirubbio in https://github.com/aws/amazon-vpc-cni-k8s/pull/3755
• tests: update eksctl for CI to not use default addon PDBs by @cdirubbio in https://github.com/aws/amazon-vpc-cni-k8s/pull/3757
• Move gRPC server to Unix socket and scrub introspection data by @oliviassss in https://github.com/aws/amazon-vpc-cni-k8s/pull/3739
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3760
• build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3761
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3745
• Group github action dependency updates together by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3766
• build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3771
• test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3773
• test: fix custom-networking BeforeSuite ASG scale-to-0 wait by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3775
• Fix misleading duration format in DAD-wait timeout error message by @viveksb007 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3776
• build(deps): bump the other-deps group with 2 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3772
• build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3648
• build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3767
• build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3769
• build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3770
• chore: update VPC IP resource limits by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3778
• build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3768
• build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3748
• build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3783
• build(deps): bump the other-deps group with 3 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3784
• test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3786
• test: fix custom-networking/SGPP integration failures and teardown VPC leak by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3787
• chore: update VPC IP resource limits by @github-actions[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3790

What's Changed

• Cherrypick changes to 1.22.4 from main by @parlakisik in #3747
• fix: hyperpod ESD issue (cherry-pick of #3754 to release-1.22) by @parlakisik in #3756
• Cherry pick fixes for metrics helper tests by @jupdec in #3759
• IRSA for cni-metrics-helper tests by @jaydeokar in #3765

New Contributors

• @parlakisik made their first contribution in #3747

Full Changelog: v1.22.3...v1.22.4

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.4/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.4/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.4/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.22.4/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.22.4/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.4
amazon-k8s-cni:v1.22.4
amazon/aws-network-policy-agent:v1.4.0

This release updates the Amazon VPC CNI images to an Amazon Linux 2023 (AL2023)-based image.

What's Changed

• chore: specific NodePort in integration tests by @cdirubbio in #3716
• Migrate CNI/init/metrics base images to AL23 (latest-al23) by @Gafoor2005 in #3661

New Contributors

Full Changelog: v1.22.2...v1.22.3

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.3/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.3/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.3/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.22.3/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.22.3/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.3
amazon-k8s-cni:v1.22.3
amazon/aws-network-policy-agent:v1.3.7

⚠️ Warning: VPC CNI v1.22.2 reverts the Security Group discovery feature initially introduced in the previous version, v1.22.1.

What's Changed

• Reverting Security Group discovery feature by @cdirubbio in #3720

Full Changelog: v1.22.1...v1.22.2

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.2/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.2/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.2/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.22.2/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.22.2/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.2
amazon-k8s-cni:v1.22.2
amazon/aws-network-policy-agent:v1.3.5

• Reverting Security Group Discovery feature in https://github.com/aws/amazon-vpc-cni-k8s/pull/3720

What's Changed

Amazon VPC CNI v1.22.1 introduces enhanced subnet discovery, allowing customers to separate pod and node subnets and apply dedicated security groups to pods on secondary ENIs.

⚠️ Warning: VPC CNI v1.22.1 introduces a new DescribeSecurityGroups API call that runs per node. In clusters with a large number of nodes, this can lead to EC2 API throttling (RequestLimitExceeded). Mitigation: Disable the subnet discovery feature, or delay upgrade until a fix is available.

⚠️ IAM Policy Update Required

The enhanced subnet discovery feature (enabled by default with ENABLE_SUBNET_DISCOVERY=true) requires ec2:DescribeSubnets and ec2:DescribeSecurityGroups permissions.

Without these permissions, aws-node will fail to start (#3704, #3705).

Who needs to take action:

• IPv6 clusters — the customer-managed IAM policy does not include ec2:DescribeSubnets or ec2:DescribeSecurityGroups
• Third-party IAM management (Terraform, Pulumi, CDK, etc.) — if your tool manages the VPC CNI IAM role independently, add both permissions before upgrading

Add the following to your CNI IAM policy:

{
    "Effect": "Allow",
    "Action": [
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups"
    ],
    "Resource": "*"
}

Note: The AWS managed policy AmazonEKS_CNI_Policy already includes both permissions. If you are using the managed policy on an IPv4 cluster, no action is needed.

Alternatively, if you do not need subnet discovery, you can set ENABLE_SUBNET_DISCOVERY=false to disable the feature and avoid the new permission requirement.

Subnet Discovery

VPC CNI now supports advanced subnet selection for secondary ENIs:

• Tag subnets with kubernetes.io/role/cni=1 to include them for pod ENI allocation
• Tag subnets with kubernetes.io/role/cni=0 to exclude them (including the node's primary subnet)
• Tag security groups with kubernetes.io/role/cni=1 to apply custom security groups to ENIs in secondary subnets
• Use cni.networking.k8s.aws/cluster/<cluster-name> tags to scope subnets to specific clusters in multi-cluster VPCs

This feature is enabled by default via ENABLE_SUBNET_DISCOVERY=true.

Features

• Enhanced subnet discovery with subnet exclusion, custom security groups, and cluster-specific tags (#3463, @dshehbaj, @haouc)
• Migrate subnet cluster tag prefix to cni.networking.k8s.aws/cluster/ and fix primary subnet exclusion logic (#3647, @haouc)

Full Changelog: v1.21.2...v1.22.1

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.22/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.22/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.22/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/release-1.22/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.22/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.1
amazon-k8s-cni:v1.22.1
amazon/aws-network-policy-agent:v1.3.5

• feat: Enhanced subnet discovery - allow customers to exclude specific subnets from pod allocation by tagging with kubernetes.io/role/cni=0 and include subnets with kubernetes.io/role/cni=1
• feat: Custom security groups for pods on secondary ENIs - tag security groups with kubernetes.io/role/cni=1 to apply them to ENIs in discovered subnets
• feat: Cluster-specific subnet filtering using cni.networking.k8s.aws/cluster/<cluster-name> tag for multi-cluster VPC environments
• feat: Primary ENI subnet exclusion - when primary subnet is tagged with cni=0, new ENIs are created only in secondary subnets

• pkg awsutils

• pkg ec2wrapper: add func to describe subnets

• pkg ipamd: handle primary ENI exclusion

• test: add integration test

• pkg: enable subnet discovery for IPv6 mode

• test integration eni-subnet-discovery: extend tests for IPv6 mode

• pkg: use shared context for awsutils and ipamd

• pkg awsutils: fix compilation error

• pkg ipamd: clean up ENI if not previously used

• pkg ipamd: gracefully exclude primary ENI if existing pods

• test integration: add integration test for primary ENI exclusion

• pkg ipamd: fix bug when calculating currentENIs when primary ENI is excluded

• pkg ipamd: implement secondary ENI exclusion logic

• pkg ipamd: add unit test for secondary ENI exclusion

• test integration: add integ test for secondary ENI exclusion testing

• test integration: add test for security group refresh

• rebase to latest mainline chnages

• remove value check for tags

• reviewed

• updated based on comments

• add more unit tests

• primary ENI can't be easily ignored

Co-authored-by: Shehbaj Dhillon [email protected]

What's Changed

• Amazon VPC CNI now propagates the EC2 security group idle connection tracking timeout settings from the instance's primary ENI to all secondary ENIs it creates, ensuring consistent connection tracking behavior across all network interfaces. To customize these settings on the primary ENI, use a custom launch template to configure the desired connection tracking timeout values.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html#connection-tracking-timeouts

Features

• Replicate primary ENI connection tracking settings to secondary ENIs (#3666, @jaydeokar)
• Add support for extra volume mounts in aws-vpc-cni-init container (#3633, @phbergsmann)
• Add conntrack-cache-table-size to helm chart (#3617, @viveksb007)

Bug Fixes

• Fix panic in air-gapped regions: use awshttp.BuildableClient instead of *http.Client for AWS SDK HTTP client (#3672, @haouc)
• Add HTTP request timeout (10s) to AWS SDK clients to prevent indefinite hangs (#3649, @haouc)
• Fix nil pointer panic in PodLogs when Stream fails (#3671, @haouc)
• Fix missing timeout in DescribeNetworkInterfaces call (#3644, @cdirubbio)
• Fix context cancellation with DescribeNetworkInterfaces timeout (#3644, @cdirubbio)
• Fix IMDS resource leak (#3617, @viveksb007)
• Restore clobbered context in pkg/publisher (#3595, @alrs)
• Fix dropped error in pkg/networkutils (#3595, @alrs)
• Fix address issue #3620 (#3646, @gabrnavarro)
• Add userAgent to AWS API calls (#3556, @cdirubbio)
• Fix image pull policy in helm chart (#3570, @OlTrenin)

Improvements

• Enhance logging in ipamd (#3561, @supreeet)
• Improve custom networking integration tests (#3668, @yash97)
• Improve TestNew_SetsHTTPClientTimeout to assert timeout is set (#3670, @haouc)
• Build images in separate arch runner (@yash97)
• Pick up EKS CVE patched container plugin binaries for internal builds (#3571, @jupdec)
• Bundle internal binaries when available and add integration test cases (#3627, @jupdec)

Full Changelog: v1.21.1...v1.21.2

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.21/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.21/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.21/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/release-1.21/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.21/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.21.2
amazon-k8s-cni:v1.21.2
amazon/aws-network-policy-agent:v1.3.5

• Bug fixes and improvements
• Bump Network Policy Agent to v1.3.5 - Removing CPE CRD checks as the CRD should be installed by default

🚨 🚨 🚨 v1.21.1-eksbuild.7 and v1.21.1-eksbuild.8 contains a defect in Network Policy Agent version (image tag v1.3.2-v1.3.4) that may cause issues with existing network policies. For users using network policy feature, please upgrade to v1.21.1. 🚨 🚨 🚨

Fixes bug in Network Policy agent where the map pointer gets overwritten which causes issues with existing network policies

What's Changed

• Release 1.21 by @jaydeokar in #3545
• Adding CNI v1.21.1 release by @jaydeokar in #3550

Full Changelog: v1.21.0...v1.21.1

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.1/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.1/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.1/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.21.1/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.21.1/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.21.1
amazon-k8s-cni:v1.21.1
amazon/aws-network-policy-agent:v1.3.1

• Bug fix for Network Policy Agent