🥳 aws-vpc-cni v1.22.1 Automated Release! 🥑 - #1333
Open
eks-networking-bot wants to merge 1 commit into
Open
Conversation
jaydeokar
approved these changes
May 29, 2026
jaydeokar
previously requested changes
May 29, 2026
jaydeokar
left a comment
jaydeokar
left a comment
Contributor
There was a problem hiding this comment.
CRD needs to be removed ?
jaydeokar
approved these changes
May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
aws-vpc-cni v1.22.1 Automated Chart Sync! 🤖🤖
Release Notes 📝:
What's Changed
Amazon VPC CNI v1.22.1 introduces enhanced subnet discovery, allowing customers to separate pod and node subnets and apply dedicated security groups to pods on secondary ENIs.
The enhanced subnet discovery feature (enabled by default with
ENABLE_SUBNET_DISCOVERY=true) requiresec2:DescribeSubnetsandec2:DescribeSecurityGroupspermissions.Without these permissions,
aws-nodewill fail to start (#3704, #3705).Who needs to take action:
ec2:DescribeSubnetsorec2:DescribeSecurityGroupsAdd the following to your CNI IAM policy:
{ "Effect": "Allow", "Action": [ "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource": "*" }Alternatively, if you do not need subnet discovery, you can set
ENABLE_SUBNET_DISCOVERY=falseto disable the feature and avoid the new permission requirement.Subnet Discovery
VPC CNI now supports advanced subnet selection for secondary ENIs:
kubernetes.io/role/cni=1to include them for pod ENI allocationkubernetes.io/role/cni=0to exclude them (including the node's primary subnet)kubernetes.io/role/cni=1to apply custom security groups to ENIs in secondary subnetscni.networking.k8s.aws/cluster/<cluster-name>tags to scope subnets to specific clusters in multi-cluster VPCsThis feature is enabled by default via
ENABLE_SUBNET_DISCOVERY=true.Features
cni.networking.k8s.aws/cluster/and fix primary subnet exclusion logic (Migrate subnet cluster tag prefix and fix primary subnet exclusion logic amazon-vpc-cni-k8s#3647, @haouc)Full Changelog: aws/amazon-vpc-cni-k8s@v1.21.2...v1.22.1
To manually apply this release:
Note that the following regions use different manifests:
us-gov-east-1:
us-gov-west-1:
cn:
To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.22/charts/aws-vpc-cni/README.md#installing-the-chart
Verify the update:
What's Changed
New Contributors
Full Changelog: aws/amazon-vpc-cni-k8s@v1.22.0...v1.22.1