🥳 cni-metrics-helper v1.23.0 Automated Release! 🥑

[eks-networking-bot]

cni-metrics-helper v1.23.0 Automated Chart Sync! 🤖🤖

Release Notes 📝:

Warning

If you have Network Policy enabled, Amazon VPC CNI v1.23.0 must be paired with Network Policy Agent v1.4.1. This release moves communication with IPAMD from TCP to a Unix domain socket, which earlier Network Policy Agent versions do not support. Upgrade both components together to maintain Network Policy functionality.
VPC CNI v1.23.0 also moves the aws-node liveness and readiness probes from TCP port 50051 to unix:///var/run/aws-node/ipamd.sock.The v1.23.0 Helm chart and installation manifests include the updated probe configuration. Self-managed users should use the v1.23.0 chart or manifests and update any custom livenessProbe or readinessProbe overrides that still target :50051; otherwise, aws-node may fail its health checks and restart or remain unready.

What's Changed

• chore: deps bump for CVE fix by @viveksb007 in chore: deps bump for CVE fix amazon-vpc-cni-k8s#3689
• chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 by @nakshah87 in chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 amazon-vpc-cni-k8s#3687
• Add ec2:DescribeSecurityGroups to IAM policy by @johanneswuerbach in Add ec2:DescribeSecurityGroups to IAM policy amazon-vpc-cni-k8s#3709
• Add prerouting connmark rules through nftable instead of iptables. by @yash97 in Add prerouting connmark rules through nftable instead of iptables. amazon-vpc-cni-k8s#3588
• Mixed os snat weekly cron by @yash97 in Mixed os snat weekly cron amazon-vpc-cni-k8s#3707
• pkg/ipamd: fix dropped test error by @alrs in pkg/ipamd: fix dropped test error amazon-vpc-cni-k8s#3622
• Fix unmanaged eni by @jaydeokar in Fix unmanaged eni amazon-vpc-cni-k8s#3660
• Latest nginx by @Issacwww in Latest nginx amazon-vpc-cni-k8s#3733
• chore: update VPC IP resource limits by @github-actions[bot] in chore: update VPC IP resource limits amazon-vpc-cni-k8s#3673
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in build(deps): bump actions/checkout from 6.0.2 to 6.0.3 amazon-vpc-cni-k8s#3718
• build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 by @dependabot[bot] in build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 amazon-vpc-cni-k8s#3715
• build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent by @dependabot[bot] in build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent amazon-vpc-cni-k8s#3714
• build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 amazon-vpc-cni-k8s#3679
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in build(deps): bump actions/stale from 10.2.0 to 10.3.0 amazon-vpc-cni-k8s#3701
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 amazon-vpc-cni-k8s#3700
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 by @dependabot[bot] in build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 amazon-vpc-cni-k8s#3641
• chore: cleanup dead code from esgd revert by @cdirubbio in chore: cleanup dead code from esgd revert amazon-vpc-cni-k8s#3728
• test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup by @yash97 in test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup amazon-vpc-cni-k8s#3742
• build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 by @dependabot[bot] in build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 amazon-vpc-cni-k8s#3750
• build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 amazon-vpc-cni-k8s#3751
• build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent by @dependabot[bot] in build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent amazon-vpc-cni-k8s#3749
• fix: resolve ci account vpc leaking during ITs by @cdirubbio in fix: resolve ci account vpc leaking during ITs amazon-vpc-cni-k8s#3755
• tests: update eksctl for CI to not use default addon PDBs by @cdirubbio in tests: update eksctl for CI to not use default addon PDBs amazon-vpc-cni-k8s#3757
• Move gRPC server to Unix socket and scrub introspection data by @oliviassss in Move gRPC server to Unix socket and scrub introspection data amazon-vpc-cni-k8s#3739
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 amazon-vpc-cni-k8s#3760
• build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 amazon-vpc-cni-k8s#3761
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in build(deps): bump actions/checkout from 6.0.3 to 7.0.0 amazon-vpc-cni-k8s#3745
• Group github action dependency updates together by @jaydeokar in Group github action dependency updates together amazon-vpc-cni-k8s#3766
• build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 amazon-vpc-cni-k8s#3771
• test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak by @yash97 in test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak amazon-vpc-cni-k8s#3773
• test: fix custom-networking BeforeSuite ASG scale-to-0 wait by @yash97 in test: fix custom-networking BeforeSuite ASG scale-to-0 wait amazon-vpc-cni-k8s#3775
• Fix misleading duration format in DAD-wait timeout error message by @viveksb007 in Fix misleading duration format in DAD-wait timeout error message amazon-vpc-cni-k8s#3776
• build(deps): bump the other-deps group with 2 updates by @dependabot[bot] in build(deps): bump the other-deps group with 2 updates amazon-vpc-cni-k8s#3772
• build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in build(deps): bump the aws-dependencies group across 1 directory with 11 updates amazon-vpc-cni-k8s#3648
• build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent by @dependabot[bot] in build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent amazon-vpc-cni-k8s#3767
• build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 amazon-vpc-cni-k8s#3769
• build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 by @dependabot[bot] in build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 amazon-vpc-cni-k8s#3770
• chore: update VPC IP resource limits by @jaydeokar in chore: update VPC IP resource limits amazon-vpc-cni-k8s#3778
• build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory by @dependabot[bot] in build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory amazon-vpc-cni-k8s#3768
• build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory by @dependabot[bot] in build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory amazon-vpc-cni-k8s#3748
• build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group by @dependabot[bot] in build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group amazon-vpc-cni-k8s#3783
• build(deps): bump the other-deps group with 3 updates by @dependabot[bot] in build(deps): bump the other-deps group with 3 updates amazon-vpc-cni-k8s#3784
• test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) by @yash97 in test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) amazon-vpc-cni-k8s#3786
• test: fix custom-networking/SGPP integration failures and teardown VPC leak by @yash97 in test: fix custom-networking/SGPP integration failures and teardown VPC leak amazon-vpc-cni-k8s#3787
• chore: update VPC IP resource limits by @github-actions[bot] in chore: update VPC IP resource limits amazon-vpc-cni-k8s#3790
• Create the host-side veth directly in the host namespace via the netlink PeerNamespace attribute by @amrmahdi in Create the host-side veth directly in the host namespace via the netlink PeerNamespace attribute amazon-vpc-cni-k8s#3764
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the other-deps group by @dependabot[bot] in build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the other-deps group amazon-vpc-cni-k8s#3795
• test: replace fixed sleeps with readiness polls in pod-eni and eni-subnet-discovery suites by @yash97 in test: replace fixed sleeps with readiness polls in pod-eni and eni-subnet-discovery suites amazon-vpc-cni-k8s#3797
• Changelog, chart, and manifest updates for v1.23.0 release by @yash97 in Changelog, chart, and manifest updates for v1.23.0 release amazon-vpc-cni-k8s#3792
• sync release 1.23 with master by @yash97 in sync release 1.23 with master amazon-vpc-cni-k8s#3791
• test: bump kops node image to Ubuntu 22.04 to fix containerd glibc mismatch by @yash97 in test: bump kops node image to Ubuntu 22.04 to fix containerd glibc mismatch amazon-vpc-cni-k8s#3789
• test: increase cni integration suite timeout to 120m by @yash97 in test: increase cni integration suite timeout to 120m amazon-vpc-cni-k8s#3806
• Sync release 1.23 with master by @yash97 in Sync release 1.23 with master amazon-vpc-cni-k8s#3807
• cve fix by @yash97 in cve fix amazon-vpc-cni-k8s#3808
• (bug) Return error if the parsing fails and UT by @jaydeokar in (bug) Return error if the parsing fails and UT amazon-vpc-cni-k8s#3802
• test: fix flaky ENI-placement precondition in cni integration suite by @yash97 in test: fix flaky ENI-placement precondition in cni integration suite amazon-vpc-cni-k8s#3810
• Sync release-1.23 with master by @yash97 in Sync release-1.23 with master amazon-vpc-cni-k8s#3813

New Contributors

• @johanneswuerbach made their first contribution in Add ec2:DescribeSecurityGroups to IAM policy amazon-vpc-cni-k8s#3709
• @amrmahdi made their first contribution in Create the host-side veth directly in the host namespace via the netlink PeerNamespace attribute amazon-vpc-cni-k8s#3764

Full Changelog: aws/amazon-vpc-cni-k8s@v1.22.4...v1.23.0

To manually apply this release:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni.yaml

Note that the following regions use different manifests:

us-gov-east-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-east-1.yaml

us-gov-west-1:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-west-1.yaml

cn:

kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.23.0/config/master/aws-k8s-cni-cn.yaml

To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.23.0/charts/aws-vpc-cni/README.md#installing-the-chart

Verify the update:

$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3

amazon-k8s-cni-init:v1.23.0
amazon-k8s-cni:v1.23.0
amazon/aws-network-policy-agent:v1.4.1