github.com/aws/amazon-vpc-cni-k8s

• pkg awsutils

• pkg ec2wrapper: add func to describe subnets

• pkg ipamd: handle primary ENI exclusion

• test: add integration test

• pkg: enable subnet discovery for IPv6 mode

• test integration eni-subnet-discovery: extend tests for IPv6 mode

• pkg: use shared context for awsutils and ipamd

• pkg awsutils: fix compilation error

• pkg ipamd: clean up ENI if not previously used

• pkg ipamd: gracefully exclude primary ENI if existing pods

• test integration: add integration test for primary ENI exclusion

• pkg ipamd: fix bug when calculating currentENIs when primary ENI is excluded

• pkg ipamd: implement secondary ENI exclusion logic

• pkg ipamd: add unit test for secondary ENI exclusion

• test integration: add integ test for secondary ENI exclusion testing

• test integration: add test for security group refresh

• rebase to latest mainline chnages

• remove value check for tags

• reviewed

• updated based on comments

• add more unit tests

• primary ENI can't be easily ignored

Co-authored-by: Shehbaj Dhillon dshehbaj@amazon.com

What's Changed

• Amazon VPC CNI now propagates the EC2 security group idle connection tracking timeout settings from the instance's primary ENI to all secondary ENIs it creates, ensuring consistent connection tracking behavior across all network interfaces. To customize these settings on the primary ENI, use a custom launch template to configure the desired connection tracking timeout values.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html#connection-tracking-timeouts

Features

• Replicate primary ENI connection tracking settings to secondary ENIs (#3666, @jaydeokar)
• Add support for extra volume mounts in aws-vpc-cni-init container (#3633, @phbergsmann)
• Add conntrack-cache-table-size to helm chart (#3617, @viveksb007)

Bug Fixes

• Fix panic in air-gapped regions: use awshttp.BuildableClient instead of *http.Client for AWS SDK HTTP client (#3672, @haouc)
• Add HTTP request timeout (10s) to AWS SDK clients to prevent indefinite hangs (#3649, @haouc)
• Fix nil pointer panic in PodLogs when Stream fails (#3671, @haouc)
• Fix missing timeout in DescribeNetworkInterfaces call (#3644, @cdirubbio)
• Fix context cancellation with DescribeNetworkInterfaces timeout (#3644, @cdirubbio)
• Fix IMDS resource leak (#3617, @viveksb007)
• Restore clobbered context in pkg/publisher (#3595, @alrs)
• Fix dropped error in pkg/networkutils (#3595, @alrs)
• Fix address issue #3620 (#3646, @gabrnavarro)
• Add userAgent to AWS API calls (#3556, @cdirubbio)
• Fix image pull policy in helm chart (#3570, @OlTrenin)

Improvements

• Enhance logging in ipamd (#3561, @supreeet)
• Improve custom networking integration tests (#3668, @yash97)
• Improve TestNew_SetsHTTPClientTimeout to assert timeout is set (#3670, @haouc)
• Build images in separate arch runner (@yash97)
• Pick up EKS CVE patched container plugin binaries for internal builds (#3571, @jupdec)
• Bundle internal binaries when available and add integration test cases (#3627, @jupdec)

Full Changelog: v1.21.1...v1.21.2

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.21/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.21/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/release-1.21/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/release-1.21/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.21/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.21.2
amazon-k8s-cni:v1.21.2
amazon/aws-network-policy-agent:v1.3.5

🚨 🚨 🚨 v1.21.1-eksbuild.7 and v1.21.1-eksbuild.8 contains a defect in Network Policy Agent version (image tag v1.3.2-v1.3.4) that may cause issues with existing network policies. For users using network policy feature, please upgrade to v1.21.1. 🚨 🚨 🚨

Fixes bug in Network Policy agent where the map pointer gets overwritten which causes issues with existing network policies

What's Changed

• Release 1.21 by @jaydeokar in #3545
• Adding CNI v1.21.1 release by @jaydeokar in #3550

Full Changelog: v1.21.0...v1.21.1

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.1/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.1/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.1/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.21.1/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.21.1/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.21.1
amazon-k8s-cni:v1.21.1
amazon/aws-network-policy-agent:v1.3.1

🚨 🚨 🚨 v1.21.0 contains a defect in Network Policy Agent version (image tag v1.3.0) that may cause issues with existing network policies. For users using network policy feature, please upgrade to v1.21.1. 🚨 🚨 🚨

What's New

• This release adds support for Cluster Network Policy in AWS Network Policy Agent which allows cluster administrators to define network policies with Layer 3 and 4 network rules at the cluster scope

What's Changed

• chore: update VPC IP resource limits by @github-actions[bot] in #3521
• Bump peter-evans/create-pull-request from 7.0.5 to 7.0.9 by @dependabot[bot] in #3519
• Bump golang.org/x/crypto from 0.40.0 to 0.45.0 by @dependabot[bot] in #3515
• Merge into release branch by @jaydeokar in #3522
• updating changelog by @yash97 in #3525
• chore: update VPC IP resource limits by @github-actions[bot] in #3532
• updating setup go fo gh action by @yash97 in #3537
• update tags by @yash97 in #3535
• update golang version by @yash97 in #3536
• Master to Release-1.21 sync by @jaydeokar in #3539
• Merge pull request #3522 from aws/master by @jaydeokar in #3540
• Release notes for v1.21.0 by @jaydeokar in #3547
• release-1.21 sync with master by @jaydeokar in #3548

Full Changelog: v1.20.5...v1.21.0

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.0/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.0/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.21.0/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.21.0/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.21.0/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.21.0
amazon-k8s-cni:v1.21.0
amazon/aws-network-policy-agent:v1.3.0

What's Changed

• enabling pod egress traffic test for under mac address policy variation by @yash97 in #3459
• Bump the aws-dependencies group with 9 updates by @dependabot[bot] in #3465
• chore: update VPC IP resource limits by @github-actions[bot] in #3476
• bumping kops tag to v1.34 by @Supreeth095 in #3477
• feat: add retry logic for netlink dump operations by @dcoppa in #3440
• chore: update VPC IP resource limits by @github-actions[bot] in #3481
• Updating network policy agent version by @jaydeokar in #3491
• Bump actions/dependency-review-action from 4.3.3 to 4.8.1 by @dependabot[bot] in #3485
• Bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #3486
• Gracefully handle v4 (unmanaged) ENIs on IPv6 node by @jupdec in #3489
• Go bump by @Supreeth095 in #3500
• chore: update VPC IP resource limits by @github-actions[bot] in #3502
• nit: Update README to separate ENI Tags from Subnet Tags by @cdirubbio in #3508
• Merge master to Release 1.20 for v1.20.5 release by @Supreeth095 in #3504
• Sync Release 1.20 with Master by @jaydeokar in #3510
• Bumping up containerd version for CVE fix by @jaydeokar in #3512
• chore: update VPC IP resource limits by @github-actions[bot] in #3514
• Adding change log and release notes for v1.20.5 by @nakshah87 in #3511
• Merge master into release-1.20 branch by @yash97 in #3517

New Contributors

• @cdirubbio made their first contribution in #3508
• @nakshah87 made their first contribution in #3511

Full Changelog: v1.20.4...v1.20.5

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.20.5/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.20.5/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.20.5/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/release-1.20/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.20.5/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.20.5
amazon-k8s-cni:v1.20.5
amazon/aws-network-policy-agent:v1.2.7

• Updating SNAT variable documentation by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3439
• Bump the k8s-dependencies group with 5 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3426
• Bump the aws-dependencies group with 11 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3424
• Optimize ENI slot reservation for non-supported instance type by @phuhung273 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3250
• Include all plugins for Multus by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3470
• fix: format string bug in GetPodMTU error logging by @dcoppa in https://github.com/aws/amazon-vpc-cni-k8s/pull/3471

• chore: update VPC IP resource limits by @github-actions[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3441
• chore: update VPC IP resource limits by @github-actions[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3453
• Optionally setting up Route table for non zero Network Cards if AMI is already configuring at bootup by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3452
• Add overrideRepository images option by @QuentinBtd in https://github.com/aws/amazon-vpc-cni-k8s/pull/3435
• Initialize controller-runtime logger by @dcoppa in https://github.com/aws/amazon-vpc-cni-k8s/pull/3443

• Bump github.com/samber/lo from 1.49.1 to 1.51.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3386
• Bump github.com/prometheus/client_model from 0.6.1 to 0.6.2 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3385
• Bump the aws-dependencies group with 11 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3384
• Adding release notes and chart update by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3399
• updating tags by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3400
• Add and configure soak tests workflow by @Supreeth095 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3404
• Add and configure soak tests workflow by @Supreeth095 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3407
• Bump actions/checkout from 4.1.7 to 5.0.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3409
• Bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3401
• Removing pinning of golang version by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3411
• Bump the k8s-dependencies group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3413
• chore: update VPC IP resource limits by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3419
• chore: update VPC IP resource limits by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3420
• Fetch only necessary plugins by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3416
• chore: update VPC IP resource limits by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3422
• chore: update VPC IP resource limits by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3438
• Move npagent server port to unix socket by @Pavani-Panakanti in https://github.com/aws/amazon-vpc-cni-k8s/pull/3442

• Adding release notes for mult-nic feature by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3350
• bumping kops tag by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3355
• updating kops tag in workflow by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3356
• bumping kops tag to v1.33.0-beta.1 by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3357
• adding github action monitoring in dependabot by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3360
• Bump actions/setup-go from 5.0.1 to 5.5.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3365
• Bump docker/setup-buildx-action from 3.3.0 to 3.11.1 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3362
• adding manual run option to integration test workflow by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3369
• Bump google.golang.org/protobuf from 1.36.5 to 1.36.6 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3367
• Bump the aws-dependencies group with 3 updates by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3366
• updated README.md by @viveksb007 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3371
• Bump docker/setup-qemu-action from 3.0.0 to 3.6.0 by @dependabot[bot] in https://github.com/aws/amazon-vpc-cni-k8s/pull/3373
• bypassing udev interference by assigning mac address to host side veth by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3354
• Updating static config for instances and better error handling by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3378
• fixing codecoverage report issue by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3382
• Merge from master to release-1.20 by @jaydeokar in https://github.com/aws/amazon-vpc-cni-k8s/pull/3376

• Feature - Adding support in CNI for managing multiple network interface card on the instance in #3347,#3349
• Dependency - Bump helm.sh/helm/v3 from 3.18.1 to 3.18.4 in #3346
• Dependency - Bump aws-dependencies in #3337
• Improvement - Build CNI plugins from source in #3343
• Fix - Fix error when Network policy agent GRPC call fails in #3320
• Fix - Fix race condition when force deleting pod using a security group for pod feature in #3304
• Improvement - Add latency metrics for ipamd init in #3301

• Dependency - Bump k8s.io/apimachinery from 0.32.3 to 0.33.0 by @dependabot in #3279
• Dependency - Bump golang.org/x/sys from 0.31.0 to 0.32.0 in /test/agent in #3280
• Fix - fixed integration test script by @viveksb007 in #3282
• Fix - Adding CVE fixes and remove pinned dependencies by @jaydeokar in #3283
• Dependency - Updating netlink to v1.3.1 by @jaydeokar in #3286
• Feature - adding ENABLE_IMDS_ONLY_MODE configuration so ipamd will not interact with EC2 for node init and reconcile by @bhaoz in #3287

• Fix - fixed node init failure when using custom networking and SGPP @oliviassss in #3277

• Improvement - Update AWS VPC CNI to SDK V2 Update - master branch by @orsenthil in #3070
• Fix - Handle EKS Service for the Beta Endpoint by @orsenthil in #3143
• Manifest - Adding multus v4.1.4 manifest by @jaydeokar in #3154
• Tests - KOps Integration Test Follow Up by @dshehbaj in #3149
• Fix - fix(test): add volume mount for docker-func-test target by @omerap12 in #3160
• Fix - cni-metrics-helper metrics: do type assertion before type casting by @dshehbaj in #3152
• Improvement - Add CNINode to cache filter by @dims in #3164
• Fix - remove null creationTimestamp from CRD metadata by @omerap12 in #3163
• Fix - issue with primary ENI ip lookup when an ENI has both IPv4 and IPv6 Address Assigned by @orsenthil in #3156
• Improvement - Use awshttp client instead of smithy httpclient by @orsenthil in #3193
• Fix - retryOnConflict shouldnt' retry on NotFound by @haouc in #3192
• Improvement - Update awsutils.go by @git4example in #3191
• Improvement - Add grpc call to fetch networkpolicymode from NP by @Pavani-Panakanti in #3202
• Improvement - Changes to attach probes at pod start by @haouc in #3206
• Improvement - adding eni owner tag if cluster name is present by @yash97 #3228
• Improvement - only cache CNINode when SGP is in use by @oliviassss #3242
• Improvement - Remove dependency on apiserver for IPAMD startup by @oliviassss #3243
• Fix - Skip configuring NP related if network_policy_enforcing_mode is not set by @Pavani-Panakanti #3254
• Doc and charts update

• Improvement - Changes to attach probes at pod start by @pavanipt and @haouc in https://github.com/aws/amazon-vpc-cni-k8s/pull/3206
• Improvement - Add grpc call to fetch networkpolicymode from NP by @pavanipt in https://github.com/aws/amazon-vpc-cni-k8s/pull/3202
• Update NP agent to v1.2.0 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3209

• Feature: run make generate-limits to update the max pods file by @tzneal in https://github.com/aws/amazon-vpc-cni-k8s/pull/3141
• Tests: Fix KOps Integration Test by @dshehbaj in https://github.com/aws/amazon-vpc-cni-k8s/pull/3140
• Bug-Fix: Revert "utils prometheusmetrics: convert gauges to counters (#3093)" by @orsenthil in https://github.com/aws/amazon-vpc-cni-k8s/pull/3147
• Docs: Update NP strict mode doc by @Pavani-Panakanti in https://github.com/aws/amazon-vpc-cni-k8s/pull/3125
• Docs: adding email to share node bundle by @yash97 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3134
• Dependency: crypto module dependency https://github.com/aws/amazon-vpc-cni-k8s/pull/3151
• Dependency: Dependabot PRs. https://github.com/aws/amazon-vpc-cni-k8s/pull/3135
• Dependency: Dependabot PRs. https://github.com/aws/amazon-vpc-cni-k8s/pull/3137
• Dependency: Bump golang.org/x/sys from 0.27.0 to 0.28.0 in /test/agent by @dependabot in https://github.com/aws/amazon-vpc-cni-k8s/pull/3138

• Manifest update for unsupported compute type

What's Changed

• Improvement - Add byobject filter on nodes #2888

• Improvement - Move KUBE_CONFIG_PATH variable to KUBECONFIG variable #3015

• Improvement - Update Limits and Add New Instance Types. #3077

• Dependency - Bump google.golang.org/grpc from 1.62.0 to 1.67.1 #3056

• Dependency - Bump github.com/prometheus/common from 0.53.0 to 0.60.0 #3057

• Dependency - Bump golang.org/x/sys from 0.24.0 to 0.25.0 in /test/agent #3052

• Dependency - update upstream cni to 1.5.1 #3065

• Dependency - Bump k8s.io/client-go from 0.30.3 to 0.31.1 #3036

• Dependency - Bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.0 #3054

• Docs - Document the limitation of SGP with kube-proxy IPVS mode. #3064

• Bugfix - https://github.com/aws/amazon-vpc-cni-k8s/pull/3088

• Bugfix - Fix the SCRIPT_DIR reference in integration tests. #3090