Go modules · #741 by repository stars

github.com/aws/amazon-vpc-cni-k8s

v1.23.2aws/amazon-vpc-cni-k8s ↗New releases in your daily digest, changelog included.

Last release 2 days ago
06 Oct 2026
Ships on a steady schedule
a new release about every 9 days
Nearly every release is documented
notes for 56 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
8 years old
647 releases · first in 2018

Release timeline

647 releases since 2018

2018202020222024

Releases

v1.23.229 Sept 2026
chore: bump to go 1.26.6 by @zac-nixon in #3865
What's Changed

chore: bump to go 1.26.6 by @zac-nixon in #3865

fix: ESD fail open on DescribeSubnets call failure by @cdirubbio in #3843

build(deps): bump the other-deps group across 1 directory with 2 updates by @dependabot[bot] in #3870

chore: fix flaky SNAT test by @zac-nixon in #3869

build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #3867

build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #3850

build(deps): bump the k8s-dependencies group across 1 directory with 4 updates by @dependabot[bot] in #3866

build(deps): bump github.com/containernetworking/plugins from 1.9.0 to 1.9.1 by @dependabot[bot] in #3851

Use sagemaker:AttachClusterNodeNetworkInterface api for HyperPod nodes by @AshwinS27 in #3874

bug(routed-eni): reject invalid vlan ids by @zac-nixon in #3854

build(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 in the aws-deps group across 1 directory by @dependabot[bot] in #3860

build(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in #3853

build(deps): bump helm.sh/helm/v4 from 4.2.2 to 4.3.0 by @dependabot[bot] in #3852

tests bump curl image version by @cdirubbio in #3881

Update Nginx image to version 1.31.5-alpine-slim by @cdirubbio in #3883

Update perf-cluster AMI family to AmazonLinux2023 by @cdirubbio in #3884

Self-heal IPv6 datastore and harden EC2 client retry by @emilyhuaa in #3873

Prepare v1.23.2 release by @parlakisik in #3885

Merge master to Release 1.23 for v1.23.2 release by @parlakisik in #3886

Fix kOps test cleanup reliability by @yash97 in #3846

test: update nginx image by @jupdec in #3891

Bump network-policy-agent to v1.4.3 by @jupdec in #3888

test: bump TestAgentImage to recent build tag of aws-vpc-cni-test-helper by @jupdec in #3892

Pull in test fixes for 1.23.2 release by @jupdec in #3896

New Contributors

@AshwinS27 made their first contribution in #3874

@emilyhuaa made their first contribution in #3873

Full Changelog: v1.23.1...v1.23.2

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.2/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.2/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.2/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.2/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.23.2/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.23.2 amazon-k8s-cni:v1.23.2 amazon/aws-network-policy-agent:v1.4.3

Additional notes2 sources agree

Self-heal the IPv6 datastore and harden EC2 client retry behavior (#3873, @emilyhuaa)
Reject invalid VLAN IDs in routed-eni, validating before veth creation (#3854, @zac-nixon)
Fail open when the DescribeSubnets call for ENI subnet discovery fails (#3843, @cdirubbio)
Use the sagemaker:AttachClusterNodeNetworkInterface API for HyperPod nodes (#3874, @AshwinS27)
Bump to Go 1.26.6 (#3865, @zac-nixon)
Fix flaky SNAT test (#3869, @zac-nixon)
Bump the curl image version used in tests (#3881, @cdirubbio)
Update the Nginx test image to 1.31.5-alpine-slim (#3883, @cdirubbio)
Update perf-cluster AMI family to AmazonLinux2023 (#3884, @cdirubbio)
Bump the aws-dependencies group with 11 updates (aws-sdk-go-v2 services, smithy-go) (#3850)
Bump the k8s-dependencies group with 4 updates (#3866)
Bump the other-deps group with 2 updates (docker/setup-qemu-action, docker/setup-buildx-action) (#3870)
Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#3867)
Bump github.com/containernetworking/plugins from 1.9.0 to 1.9.1 (#3851)
Bump google.golang.org/protobuf to 1.36.12 (#3853)
Bump helm.sh/helm/v4 from 4.2.2 to 4.3.0 (#3852)
Bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 (#3860)

Open source →

v1.23.14 Sept 2026

test: pin busybox and curl image by @Issacwww in #3820

What's Changed

test: pin busybox and curl image by @Issacwww in #3820
fix(helm): render podMonitor.scrapeTimeout in PodMonitor template by @OdaloV in #3804
build(deps): bump github.com/go-logr/logr from 1.4.3 to 1.4.4 by @dependabot[bot] in #3817
build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #3815
build(deps): bump github.com/apparentlymart/go-cidr from 1.1.0 to 1.1.1 by @dependabot[bot] in #3816
build(deps): bump actions/stale from 10.4.0 to 11.0.0 in the other-deps group across 1 directory by @dependabot[bot] in #3812
build(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 in the aws-deps group by @dependabot[bot] in #3794
build(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 by @dependabot[bot] in #3828
build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.22.3 to 1.22.4 in /test/agent in the aws-dependencies group by @dependabot[bot] in #3814
chore: update VPC IP resource limits by @github-actions[bot] in #3801
Clean up primaryIP map entry when ENI is freed in tryFreeENI by @jaydeokar in #3727
Serve node IP and instance ID to the network policy agent via gRPC by @viveksb007 in #3827
Add Region to NetworkPolicyAgentConfigReply by @viveksb007 in #3829
bug: don't fail on ipv6-only unmanaged ENI by @cdirubbio in #3681
Prepare v1.23.1 release by @cdirubbio in #3838
chore: update VPC IP resource limits by @github-actions[bot] in #3839
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 by @dependabot[bot] in #3855
Release-1.23 to Master sync by @jaydeokar in #3845
Master to release-1.23 by @zac-nixon in #3864

New Contributors

@OdaloV made their first contribution in #3804

Full Changelog: v1.23.0...v1.23.1

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.1/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.1/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.1/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.23.1/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.23.1/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.23.1
amazon-k8s-cni:v1.23.1
amazon/aws-network-policy-agent:v1.4.2

Open source →

Additional notes2 sources agree

Serve node IP and instance ID to the Network Policy Agent via gRPC — the agent now sources NodeIPv4, NodeIPv6, and InstanceID from ipamd instead of querying IMDS (#3827, @viveksb007)
Add Region to NetworkPolicyAgentConfigReply so the agent can resolve its region without calling IMDS (#3829, @viveksb007)
Update VPC IP resource limits (#3801)
Don't fail on IPv6-only unmanaged ENIs in an IPv4 cluster (handled via getENIMetadata) (#3681, @cdirubbio)
Clean up the primaryIP map entry when an ENI is freed in tryFreeENI (#3727)
Helm: render podMonitor.scrapeTimeout in the PodMonitor template (#3804, @OdaloV)
Pin busybox and curl images used in tests (#3820)
Bump github.com/go-logr/logr from 1.4.3 to 1.4.4 (#3817)
Bump the aws-dependencies group with 11 updates (aws-sdk-go-v2 services, vpc-resource-controller, smithy-go) (#3815)
Bump github.com/apparentlymart/go-cidr from 1.1.0 to 1.1.1 (#3816)
Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#3828)
Bump github.com/aws/amazon-vpc-cni-k8s (test/agent) from 1.22.3 to 1.22.4 (#3814)
Bump actions/stale from 10.4.0 to 11.0.0 (#3812)
Bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 (#3794)

v1.23.031 Jul 2026

Warning If you have Network Policy enabled, Amazon VPC CNI v1.23.0 must be paired with Network Policy Agent v1.4.1. This release moves communication w

Warning

If you have Network Policy enabled, Amazon VPC CNI v1.23.0 must be paired with Network Policy Agent v1.4.1. This release moves communication with IPAMD from TCP to a Unix domain socket, which earlier Network Policy Agent versions do not support. Upgrade both components together to maintain Network Policy functionality.
VPC CNI v1.23.0 also moves the aws-node liveness and readiness probes from TCP port 50051 to unix:///var/run/aws-node/ipamd.sock.The v1.23.0 Helm chart and installation manifests include the updated probe configuration. Self-managed users should use the v1.23.0 chart or manifests and update any custom livenessProbe or readinessProbe overrides that still target :50051; otherwise, aws-node may fail its health checks and restart or remain unready.
If customer wants to rollback from this version, they must rollback to version v1.22.4, if they use Network Policy feature.

What's Changed

chore: deps bump for CVE fix by @viveksb007 in #3689
chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 by @nakshah87 in #3687
Add ec2:DescribeSecurityGroups to IAM policy by @johanneswuerbach in #3709
Add prerouting connmark rules through nftable instead of iptables. by @yash97 in #3588
Mixed os snat weekly cron by @yash97 in #3707
pkg/ipamd: fix dropped test error by @alrs in #3622
Fix unmanaged eni by @jaydeokar in #3660
Latest nginx by @Issacwww in #3733
chore: update VPC IP resource limits by @github-actions[bot] in #3673
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #3718
build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 by @dependabot[bot] in #3715
build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent by @dependabot[bot] in #3714
build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #3679
build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #3701
build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #3700
build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 by @dependabot[bot] in #3641
chore: cleanup dead code from esgd revert by @cdirubbio in #3728
test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup by @yash97 in #3742
build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 by @dependabot[bot] in #3750
build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in #3751
build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent by @dependabot[bot] in #3749
fix: resolve ci account vpc leaking during ITs by @cdirubbio in #3755
tests: update eksctl for CI to not use default addon PDBs by @cdirubbio in #3757
Move gRPC server to Unix socket and scrub introspection data by @oliviassss in #3739
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3760
build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3761
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #3745
Group github action dependency updates together by @jaydeokar in #3766
build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in #3771
test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak by @yash97 in #3773
test: fix custom-networking BeforeSuite ASG scale-to-0 wait by @yash97 in #3775
Fix misleading duration format in DAD-wait timeout error message by @viveksb007 in #3776
build(deps): bump the other-deps group with 2 updates by @dependabot[bot] in #3772
build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #3648
build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent by @dependabot[bot] in #3767
build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in #3769
build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 by @dependabot[bot] in #3770
chore: update VPC IP resource limits by @jaydeokar in #3778
build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory by @dependabot[bot] in #3768
build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory by @dependabot[bot] in #3748
build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group by @dependabot[bot] in #3783
build(deps): bump the other-deps group with 3 updates by @dependabot[bot] in #3784
test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) by @yash97 in #3786
test: fix custom-networking/SGPP integration failures and teardown VPC leak by @yash97 in #3787
chore: update VPC IP resource limits by @github-actions[bot] in #3790
Create the host-side veth directly in the host namespace via the netlink PeerNamespace attribute by @amrmahdi in #3764
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the other-deps group by @dependabot[bot] in #3795
test: replace fixed sleeps with readiness polls in pod-eni and eni-subnet-discovery suites by @yash97 in #3797
Changelog, chart, and manifest updates for v1.23.0 release by @yash97 in #3792
sync release 1.23 with master by @yash97 in #3791
test: bump kops node image to Ubuntu 22.04 to fix containerd glibc mismatch by @yash97 in #3789
test: increase cni integration suite timeout to 120m by @yash97 in #3806
Sync release 1.23 with master by @yash97 in #3807
cve fix by @yash97 in #3808
(bug) Return error if the parsing fails and UT by @jaydeokar in #3802
test: fix flaky ENI-placement precondition in cni integration suite by @yash97 in #3810
Sync release-1.23 with master by @yash97 in #3813

New Contributors

@johanneswuerbach made their first contribution in #3709
@amrmahdi made their first contribution in #3764

Full Changelog: v1.22.4...v1.23.0

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.23.0/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.23.0/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.23.0
amazon-k8s-cni:v1.23.0
amazon/aws-network-policy-agent:v1.4.1

Open source →

Additional notes2 sources agree

[!WARNING] This release must be run with Network Policy Agent v1.4.1. #3739 moves the IPAMD gRPC server from a TCP port to a Unix domain socket, so the Network Policy Agent must be on v1.4.1 to connect over the socket.

chore: deps bump for CVE fix by @viveksb007 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3689
chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 by @nakshah87 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3687
Adding CNI v1.21.2 release by @haouc in https://github.com/aws/amazon-vpc-cni-k8s/pull/3690
Add ec2:DescribeSecurityGroups to IAM policy by @johanneswuerbach in https://github.com/aws/amazon-vpc-cni-k8s/pull/3709
Add prerouting connmark rules through nftable instead of iptables. by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3588
Mixed os snat weekly cron by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3707
pkg/ipamd: fix dropped test error by @alrs in https://github.com/aws/amazon-vpc-cni-k8s/pull/3622
Fix unmanaged eni by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3660
Latest nginx by @Issacwww in https://github.com/aws/amazon-vpc-cni-k8s/pull/3733
chore: update VPC IP resource limits by @github-actions[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3673
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3718
build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3715
build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3714
build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3679
build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3701
build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3700
build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3641
chore: cleanup dead code from esgd revert by @cdirubbio in https://github.com/aws/amazon-vpc-cni-k8s/pull/3728
test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3742
build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3750
build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3751
build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3749
fix: resolve ci account vpc leaking during ITs by @cdirubbio in https://github.com/aws/amazon-vpc-cni-k8s/pull/3755
tests: update eksctl for CI to not use default addon PDBs by @cdirubbio in https://github.com/aws/amazon-vpc-cni-k8s/pull/3757
Move gRPC server to Unix socket and scrub introspection data by @oliviassss in https://github.com/aws/amazon-vpc-cni-k8s/pull/3739
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3760
build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3761
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3745
Group github action dependency updates together by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3766
build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3771
test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3773
test: fix custom-networking BeforeSuite ASG scale-to-0 wait by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3775
Fix misleading duration format in DAD-wait timeout error message by @viveksb007 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3776
build(deps): bump the other-deps group with 2 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3772
build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3648
build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3767
build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3769
build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3770
chore: update VPC IP resource limits by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3778
build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3768
build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3748
build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3783
build(deps): bump the other-deps group with 3 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3784
test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3786
test: fix custom-networking/SGPP integration failures and teardown VPC leak by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3787
chore: update VPC IP resource limits by @github-actions[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3790

v1.22.48 Jul 2026

Warning If you have Network Policy enabled , this release is not backward compatible. The Network Policy Agent's internal pod identifier format has ch

Warning

If you have Network Policy enabled, this release is not backward compatible. The Network Policy Agent's internal pod identifier format has changed. Existing enforcement state is migrated automatically on upgrade, but if you later downgrade, enforcement will not apply to pods created before the rollback until their nodes are replaced. If you do not use Network Policy, this change does not affect you.

What's Changed

Cherrypick changes to 1.22.4 from main by @parlakisik in #3747
fix: hyperpod ESD issue (cherry-pick of #3754 to release-1.22) by @parlakisik in #3756
Cherry pick fixes for metrics helper tests by @jupdec in #3759
IRSA for cni-metrics-helper tests by @jaydeokar in #3765

New Contributors

@parlakisik made their first contribution in #3747

Full Changelog: v1.22.3...v1.22.4

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.4/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.4/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.4/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.22.4/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.22.4/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.4
amazon-k8s-cni:v1.22.4
amazon/aws-network-policy-agent:v1.4.0

Open source →

v1.22.323 Jun 2026

This release updates the Amazon VPC CNI images to an Amazon Linux 2023 (AL2023)-based image.

Warning

If you are using Sagemaker HyperPod on Amazon EKS, please upgrade to version v1.22.4 as v1.22.0-v1.22.3 contain an issue with Enhanced Subnet Discovery on HyperPod.

What's Changed

chore: specific NodePort in integration tests by @cdirubbio in #3716
Migrate CNI/init/metrics base images to AL23 (latest-al23) by @Gafoor2005 in #3661

New Contributors

Full Changelog: v1.22.2...v1.22.3

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.3/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.3/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.3/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.22.3/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.22.3/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.3
amazon-k8s-cni:v1.22.3
amazon/aws-network-policy-agent:v1.3.7

Open source →

v1.22.210 Jun 2026

⚠️ Warning: VPC CNI v1.22.2 reverts the Security Group discovery feature initially introduced in the previous version, v1.22.1.

Warning

If you are using Sagemaker HyperPod on Amazon EKS, please upgrade to version v1.22.4 as v1.22.0-v1.22.3 contain an issue with Enhanced Subnet Discovery on HyperPod.

What's Changed

Reverting Security Group discovery feature by @cdirubbio in #3720

Full Changelog: v1.22.1...v1.22.2

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.2/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.2/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.22.2/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.22.2/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.22.2/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.2
amazon-k8s-cni:v1.22.2
amazon/aws-network-policy-agent:v1.3.5

Open source →

Additional notes2 sources agree

Reverting Security Group Discovery feature in https://github.com/aws/amazon-vpc-cni-k8s/pull/3720

Open source →

v1.22.14 May 2026

Amazon VPC CNI v1.22.1 introduces enhanced subnet discovery, allowing customers to separate pod and node subnets and apply dedicated security groups t

What's Changed

Amazon VPC CNI v1.22.1 introduces enhanced subnet discovery, allowing customers to separate pod and node subnets and apply dedicated security groups to pods on secondary ENIs.

Warning

If you are using Sagemaker HyperPod on Amazon EKS, please upgrade to version v1.22.4 as v1.22.0-v1.22.3 contain an issue with Enhanced Subnet Discovery on HyperPod.

⚠️ Warning: VPC CNI v1.22.1 introduces a new DescribeSecurityGroups API call that runs per node. In clusters with a large number of nodes, this can lead to EC2 API throttling (RequestLimitExceeded). Mitigation: Disable the subnet discovery feature, or delay upgrade until a fix is available.

⚠️ IAM Policy Update Required

The enhanced subnet discovery feature (enabled by default with ENABLE_SUBNET_DISCOVERY=true) requires ec2:DescribeSubnets and ec2:DescribeSecurityGroups permissions.

Without these permissions, aws-node will fail to start (#3704, #3705).

Who needs to take action:

IPv6 clusters — the customer-managed IAM policy does not include ec2:DescribeSubnets or ec2:DescribeSecurityGroups
Third-party IAM management (Terraform, Pulumi, CDK, etc.) — if your tool manages the VPC CNI IAM role independently, add both permissions before upgrading

Add the following to your CNI IAM policy:

{
    "Effect": "Allow",
    "Action": [
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups"
    ],
    "Resource": "*"
}

Note: The AWS managed policy AmazonEKS_CNI_Policy already includes both permissions. If you are using the managed policy on an IPv4 cluster, no action is needed.

Alternatively, if you do not need subnet discovery, you can set ENABLE_SUBNET_DISCOVERY=false to disable the feature and avoid the new permission requirement.

Subnet Discovery

VPC CNI now supports advanced subnet selection for secondary ENIs:

Tag subnets with kubernetes.io/role/cni=1 to include them for pod ENI allocation
Tag subnets with kubernetes.io/role/cni=0 to exclude them (including the node's primary subnet)
Tag security groups with kubernetes.io/role/cni=1 to apply custom security groups to ENIs in secondary subnets
Use cni.networking.k8s.aws/cluster/<cluster-name> tags to scope subnets to specific clusters in multi-cluster VPCs

This feature is enabled by default via ENABLE_SUBNET_DISCOVERY=true.

Features

Enhanced subnet discovery with subnet exclusion, custom security groups, and cluster-specific tags (#3463, @dshehbaj, @haouc)
Migrate subnet cluster tag prefix to cni.networking.k8s.aws/cluster/ and fix primary subnet exclusion logic (#3647, @haouc)

Full Changelog: v1.21.2...v1.22.1

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.22/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.22/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.22/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/release-1.22/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.22/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.22.1
amazon-k8s-cni:v1.22.1
amazon/aws-network-policy-agent:v1.3.5

Open source →

Additional notes2 sources agree

feat: Enhanced subnet discovery - allow customers to exclude specific subnets from pod allocation by tagging with kubernetes.io/role/cni=0 and include subnets with kubernetes.io/role/cni=1
feat: Custom security groups for pods on secondary ENIs - tag security groups with kubernetes.io/role/cni=1 to apply them to ENIs in discovered subnets
feat: Cluster-specific subnet filtering using cni.networking.k8s.aws/cluster/<cluster-name> tag for multi-cluster VPC environments
feat: Primary ENI subnet exclusion - when primary subnet is tagged with cni=0, new ENIs are created only in secondary subnets

Open source →