Warning
If you have Network Policy enabled, Amazon VPC CNI v1.23.0 must be paired with Network Policy Agent v1.4.1. This release moves communication with IPAMD from TCP to a Unix domain socket, which earlier Network Policy Agent versions do not support. Upgrade both components together to maintain Network Policy functionality.
VPC CNI v1.23.0 also moves the aws-node liveness and readiness probes from TCP port 50051 to unix:///var/run/aws-node/ipamd.sock.The v1.23.0 Helm chart and installation manifests include the updated probe configuration. Self-managed users should use the v1.23.0 chart or manifests and update any custom livenessProbe or readinessProbe overrides that still target :50051; otherwise, aws-node may fail its health checks and restart or remain unready.
If customer wants to rollback from this version, they must rollback to version v1.22.4, if they use Network Policy feature.
What's Changed
- chore: deps bump for CVE fix by @viveksb007 in #3689
- chore: bump containernetworking/plugins FETCH_VERSION to v1.9.0 by @nakshah87 in #3687
- Add ec2:DescribeSecurityGroups to IAM policy by @johanneswuerbach in #3709
- Add prerouting connmark rules through nftable instead of iptables. by @yash97 in #3588
- Mixed os snat weekly cron by @yash97 in #3707
- pkg/ipamd: fix dropped test error by @alrs in #3622
- Fix unmanaged eni by @jaydeokar in #3660
- Latest nginx by @Issacwww in #3733
- chore: update VPC IP resource limits by @github-actions[bot] in #3673
- build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #3718
- build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.1.0 by @dependabot[bot] in #3715
- build(deps): bump golang.org/x/sys from 0.41.0 to 0.45.0 in /test/agent by @dependabot[bot] in #3714
- build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #3679
- build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #3701
- build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #3700
- build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.32.0 by @dependabot[bot] in #3641
- chore: cleanup dead code from esgd revert by @cdirubbio in #3728
- test/eni-subnet-discovery: size replicas by instance ENI capacity and harden cleanup by @yash97 in #3742
- build(deps): bump github.com/samber/lo from 1.51.0 to 1.53.0 by @dependabot[bot] in #3750
- build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in #3751
- build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 in /test/agent by @dependabot[bot] in #3749
- fix: resolve ci account vpc leaking during ITs by @cdirubbio in #3755
- tests: update eksctl for CI to not use default addon PDBs by @cdirubbio in #3757
- Move gRPC server to Unix socket and scrub introspection data by @oliviassss in #3739
- build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3760
- build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3761
- build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #3745
- Group github action dependency updates together by @jaydeokar in #3766
- build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in #3771
- test/eni-subnet-discovery: bound subnet teardown to 5m poll and fail loud on leak by @yash97 in #3773
- test: fix custom-networking BeforeSuite ASG scale-to-0 wait by @yash97 in #3775
- Fix misleading duration format in DAD-wait timeout error message by @viveksb007 in #3776
- build(deps): bump the other-deps group with 2 updates by @dependabot[bot] in #3772
- build(deps): bump the aws-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #3648
- build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in /test/agent by @dependabot[bot] in #3767
- build(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in #3769
- build(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 by @dependabot[bot] in #3770
- chore: update VPC IP resource limits by @jaydeokar in #3778
- build(deps): bump aws-actions/configure-aws-credentials from 5579c002bb4778aa43395ef1df492868a9a1c83f to e3dd6a429d7300a6a4c196c26e071d42e0343502 in the aws-deps group across 1 directory by @dependabot[bot] in #3768
- build(deps): bump github.com/aws/amazon-vpc-cni-k8s from 1.20.4 to 1.22.3 in /test/agent in the aws-dependencies group across 1 directory by @dependabot[bot] in #3748
- build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 6.2.2 in the aws-deps group by @dependabot[bot] in #3783
- build(deps): bump the other-deps group with 3 updates by @dependabot[bot] in #3784
- test: pin nginx image to 1.31.2 (nginx:latest tag does not exist) by @yash97 in #3786
- test: fix custom-networking/SGPP integration failures and teardown VPC leak by @yash97 in #3787
- chore: update VPC IP resource limits by @github-actions[bot] in #3790
- Create the host-side veth directly in the host namespace via the netlink PeerNamespace attribute by @amrmahdi in #3764
- build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the other-deps group by @dependabot[bot] in #3795
- test: replace fixed sleeps with readiness polls in pod-eni and eni-subnet-discovery suites by @yash97 in #3797
- Changelog, chart, and manifest updates for v1.23.0 release by @yash97 in #3792
- sync release 1.23 with master by @yash97 in #3791
- test: bump kops node image to Ubuntu 22.04 to fix containerd glibc mismatch by @yash97 in #3789
- test: increase cni integration suite timeout to 120m by @yash97 in #3806
- Sync release 1.23 with master by @yash97 in #3807
- cve fix by @yash97 in #3808
- (bug) Return error if the parsing fails and UT by @jaydeokar in #3802
- test: fix flaky ENI-placement precondition in cni integration suite by @yash97 in #3810
- Sync release-1.23 with master by @yash97 in #3813
New Contributors
- @johanneswuerbach made their first contribution in #3709
- @amrmahdi made their first contribution in #3764
Full Changelog: v1.22.4...v1.23.0
To manually apply this release:
kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni.yaml
Note that the following regions use different manifests:
us-gov-east-1:
kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-east-1.yaml
us-gov-west-1:
kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.23.0/config/master/aws-k8s-cni-us-gov-west-1.yaml
cn:
kubectl apply -f https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/refs/heads/v1.23.0/config/master/aws-k8s-cni-cn.yaml
To apply this release using helm:
Follow the installation instructions in https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.23.0/charts/aws-vpc-cni/README.md#installing-the-chart
Verify the update:
$ kubectl describe daemonset aws-node -n kube-system | grep Image | cut -d "/" -f 2-3
amazon-k8s-cni-init:v1.23.0
amazon-k8s-cni:v1.23.0
amazon/aws-network-policy-agent:v1.4.1