Adding support in CNI for managing multiple network interface card on the instance

.github/workflows/integration-tests.yaml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Set up tools
         run: |
           # Install ginkgo version from go.mod

.github/workflows/kops-test.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Set up tools
         run: |
           # Install ginkgo version from go.mod
@@ -43,8 +43,8 @@ jobs:
           ROLE_ARN: ${{ secrets.EKS_CLUSTER_ROLE_ARN }}
           RUN_CNI_INTEGRATION_TESTS: false
           RUN_KOPS_TEST: true
-          K8S_VERSION: 1.31.0-beta.0
-          KOPS_VERSION: v1.29.2
+          K8S_VERSION: v1.33.0-beta.0
+          KOPS_VERSION: v1.31.0
           KOPS_RUN_TOO_NEW_VERSION: 1
         run: |
           ./scripts/run-integration-tests.sh

.github/workflows/nightly-cron-tests.yaml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Set up tools
         run: |
           # Install ginkgo version from go.mod

.github/workflows/pr-automated-tests.yaml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Set up tools
         run: |
           go install golang.org/x/lint/golint@latest
@@ -51,8 +51,22 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Build CNI images
         run: make multi-arch-cni-build
+  docker-build-init:
+    name: Build Docker init images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout latest commit in the PR
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # refs/tags/v4.1.7
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # refs/tags/v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # refs/tags/v3.3.0
+      - name: Set up Go
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
+        with:
+          go-version: "1.24"
       - name: Build CNI Init images
         run: make multi-arch-cni-init-build

.github/workflows/pr-manual-tests.yaml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Set up tools
         run: |
           # Install ginkgo version from go.mod

.github/workflows/release.yaml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Generate CNI YAML
         run: make generate-cni-yaml
       - name: Create eks-charts PR

.github/workflows/weekly-cron-tests.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # refs/tags/v5.0.1
         with:
-          go-version: "1.22"
+          go-version: "1.24"
       - name: Set up tools
         run: |
           # Install ginkgo version from go.mod

.gitignore

@@ -23,3 +23,4 @@ build/
 vendor/
 # Unignore charts directory as its confilcts with `aws-vpc-cni` binary ignore rule
 !charts/**
+scripts/cni-test/

.go-version

@@ -1 +1 @@
-1.22.12
+1.24.4

CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## v1.19.5
+* Fix - fixed node init failure when using custom networking and SGPP @oliviassss in #3277
+
+## v1.19.4
+* Improvement - Update AWS VPC CNI to SDK V2 Update - master branch by @orsenthil in #3070 
+* Fix - Handle EKS Service for the Beta Endpoint by @orsenthil in #3143
+* Manifest - Adding multus v4.1.4 manifest by @jaydeokar in #3154 
+* Tests - KOps Integration Test Follow Up by @dshehbaj in #3149
+* Fix - fix(test): add volume mount for docker-func-test target by @omerap12 in #3160
+* Fix - cni-metrics-helper metrics: do type assertion before type casting by @dshehbaj in #3152
+* Improvement - Add CNINode to cache filter by @dims in #3164
+* Fix - remove null creationTimestamp from CRD metadata by @omerap12 in #3163
+* Fix - issue with primary ENI ip lookup when an ENI has both IPv4 and IPv6 Address Assigned by @orsenthil in #3156
+* Improvement - Use awshttp client instead of smithy httpclient by @orsenthil in #3193
+* Fix - retryOnConflict shouldnt' retry on NotFound by @haouc in #3192
+* Improvement - Update awsutils.go by @git4example in #3191
+* Improvement - Add grpc call to fetch networkpolicymode from NP by @Pavani-Panakanti in #3202
+* Improvement - Changes to attach probes at pod start by @haouc in #3206
+* Improvement - adding eni owner tag if cluster name is present by @yash97 #3228
+* Improvement - only cache CNINode when SGP is in use by @oliviassss #3242
+* Improvement - Remove dependency on apiserver for IPAMD startup by @oliviassss #3243
+* Fix - Skip configuring NP related if network_policy_enforcing_mode is not set by @Pavani-Panakanti #3254
+* Doc and charts update
+
+## v1.19.3
+
+* Improvement - Changes to attach probes at pod start by @pavanipt and @haouc in https://github.com/aws/amazon-vpc-cni-k8s/pull/3206
+* Improvement - Add grpc call to fetch networkpolicymode from NP by @pavanipt in https://github.com/aws/amazon-vpc-cni-k8s/pull/3202
+* Update NP agent to v1.2.0 in https://github.com/aws/amazon-vpc-cni-k8s/pull/3209
+
+
 ## v1.19.2
 
 * Feature: run make generate-limits to update the max pods file by @tzneal in https://github.com/aws/amazon-vpc-cni-k8s/pull/3141

Makefile

@@ -41,7 +41,7 @@ BASE_IMAGE_CNI_METRICS ?= public.ecr.aws/eks-distro-build-tooling/eks-distro-min
 DESTDIR = .
 
 # IMAGE is the primary AWS VPC CNI plugin container image.
-IMAGE = amazon/amazon-k8s-cni
+IMAGE ?= amazon/amazon-k8s-cni
 IMAGE_NAME = $(IMAGE)$(IMAGE_ARCH_SUFFIX):$(VERSION)
 IMAGE_DIST = $(DESTDIR)/$(subst /,_,$(IMAGE_NAME)).tar.gz
 # INIT_IMAGE is the init container for AWS VPC CNI.
@@ -96,7 +96,7 @@ ALLPKGS = $(shell go list $(VENDOR_OVERRIDE_FLAG) ./... | grep -v cmd/packet-ver
 # BINS is the set of built command executables.
 BINS = aws-k8s-agent aws-cni grpc-health-probe cni-metrics-helper aws-vpc-cni aws-vpc-cni-init egress-cni
 # CORE_PLUGIN_DIR is the directory containing upstream containernetworking plugins
-CORE_PLUGIN_DIR = $(MAKEFILE_PATH)/core-plugins/
+CORE_PLUGIN_DIR = $(MAKEFILE_PATH)core-plugins/
 
 # DOCKER_ARGS is extra arguments passed during container image build.
 DOCKER_ARGS ?=
@@ -303,8 +303,8 @@ plugins:   ## Fetch the CNI plugins
 
 ##@ Debug script
 
-debug-script: FETCH_URL=https://raw.githubusercontent.com/awslabs/amazon-eks-ami/master/log-collector-script/linux/eks-log-collector.sh
-debug-script: VISIT_URL=https://github.com/awslabs/amazon-eks-ami/tree/master/log-collector-script/linux
+debug-script: FETCH_URL=https://raw.githubusercontent.com/awslabs/amazon-eks-ami/main/log-collector-script/linux/eks-log-collector.sh
+debug-script: VISIT_URL=https://github.com/awslabs/amazon-eks-ami/tree/main/log-collector-script/linux
 debug-script:    ## Fetching debug script from awslabs/amazon-eks-ami
 	@echo "Fetching debug script from awslabs/amazon-eks-ami"
 	@echo
@@ -374,6 +374,7 @@ generate:
 generate-limits: GOOS=
 generate-limits:    ## Generate limit file go code
 	go run $(VENDOR_OVERRIDE_FLAG) scripts/gen_vpc_ip_limits.go
+	gofmt -w pkg/vpc/vpc_ip_resource_limit.go
 
 ekscharts-sync:
 	for HELM_CHART_NAME in $(HELM_CHART_NAMES) ; do \

README.md

@@ -68,9 +68,9 @@ For help, please consider the following venues (in order):
 For all Kubernetes releases, *we recommend installing the latest VPC CNI release*. The following table denotes our *oldest* recommended
 VPC CNI version for each actively supported Kubernetes release.
 
-| Kubernetes Release | 1.31     | 1.30     | 1.29     | 1.28     | 1.27     | 1.26     | 1.25     | 1.24    |
-| ------------------ | -------- | -------- | -------- | -------- | -------- | -------- | -------- | ------- |
-| VPC CNI Version    | v1.16.4+ | v1.16.0+ | v1.14.1+ | v1.13.4+ | v1.12.5+ | v1.12.0+ | v1.11.4+ | v1.9.3+ |
+| Kubernetes Release | 1.31     | 1.30     | 1.29     | 1.28     | 1.27     | 1.26     |
+| ------------------ | -------- | -------- | -------- | -------- | -------- | -------- |
+| VPC CNI Version    | v1.16.4+ | v1.16.0+ | v1.14.1+ | v1.13.4+ | v1.12.5+ | v1.12.0+ |
 
 ## Version Upgrade
 
@@ -745,6 +745,18 @@ Network Policy agent now supports two modes for Network Policy enforcement - Str
 
 In standard mode, return traffic is always allowed for any packets that were initially sent under the default allow policy. However, once network policies are applied, the next outgoing packet will be evaluated against the active policies, and it will be allowed or denied accordingly.
 
+If you remove the Network Policy Agent container from the aws-node DaemonSet, you must also ensure that NETWORK_POLICY_ENFORCING_MODE environment variable is not set.
+Setting this value while the NP agent is absent can lead to failures during pod creation.
+
+#### `ENABLE_IMDS_ONLY_MODE` (v1.19.6+)
+
+Type: Boolean as a String
+
+Default: `false`
+
+Setting `ENABLE_IMDS_ONLY_MODE` to `true` enables the CNI plugin to operate in environments with strict VPC or IAM restrictions where EC2 API access is limited or unavailable. In this mode, the CNI plugin relies solely on the Instance Metadata Service (IMDS) to retrieve information about ENIs (Elastic Network Interfaces) and determine IP addresses to assign. These ENIs are only discovered at startup, so ENIs and IPs must be pre-attached and pre-assigned before CNI plugin starts up.
+Enabling this mode automatically sets `DISABLE_NETWORK_RESOURCE_PROVISIONING` and `DISABLE_LEAKED_ENI_CLEANUP` to `true`, as the CNI plugin will not make any EC2 API calls during operation.
+
 ### VPC CNI Feature Matrix
 
 

charts/aws-vpc-cni/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: aws-vpc-cni
-version: 1.19.2
-appVersion: "v1.19.2"
+version: 1.19.5
+appVersion: "v1.19.5"
 description: A Helm chart for the AWS VPC CNI
 icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png
 home: https://github.com/aws/amazon-vpc-cni-k8s

charts/aws-vpc-cni/README.md

@@ -48,15 +48,15 @@ The following table lists the configurable parameters for this chart and their d
 | `minimumWindowsIPTarget`| Minimum IP target value for Windows prefix delegation   | `3`                                 |
 | `branchENICooldown`     | Number of seconds that branch ENIs remain in cooldown   | `60`                                |
 | `fullnameOverride`      | Override the fullname of the chart                      | `aws-node`                          |
-| `image.tag`             | Image tag                                               | `v1.19.2`                           |
+| `image.tag`             | Image tag                                               | `v1.19.5`                           |
 | `image.domain`          | ECR repository domain                                   | `amazonaws.com`                     |
 | `image.region`          | ECR repository region to use. Should match your cluster | `us-west-2`                         |
 | `image.endpoint`        | ECR repository endpoint to use.                         | `ecr`                               |
 | `image.account`         | ECR repository account number                           | `602401143452`                      |
 | `image.pullPolicy`      | Container pull policy                                   | `IfNotPresent`                      |
 | `image.override`        | A custom docker image to use                            | `nil`                               |
 | `imagePullSecrets`      | Docker registry pull secret                             | `[]`                                |
-| `init.image.tag`        | Image tag                                               | `v1.19.2`                           |
+| `init.image.tag`        | Image tag                                               | `v1.19.5`                           |
 | `init.image.domain`     | ECR repository domain                                   | `amazonaws.com`                     |
 | `init.image.region`     | ECR repository region to use. Should match your cluster | `us-west-2`                         |
 | `init.image.endpoint`   | ECR repository endpoint to use.                         | `ecr`                               |
@@ -69,7 +69,7 @@ The following table lists the configurable parameters for this chart and their d
 | `originalMatchLabels`   | Use the original daemonset matchLabels                  | `false`                             |
 | `nameOverride`          | Override the name of the chart                          | `aws-node`                          |
 | `nodeAgent.enabled`     | If the Node Agent container should be created           | `true`                              |
-| `nodeAgent.image.tag`   | Image tag for Node Agent                                | `v1.1.5`                            |
+| `nodeAgent.image.tag`   | Image tag for Node Agent                                | `v1.2.1`                            |
 | `nodeAgent.image.domain`| ECR repository domain                                   | `amazonaws.com`                     |
 | `nodeAgent.image.region`| ECR repository region to use. Should match your cluster | `us-west-2`                         |
 | `nodeAgent.image.endpoint`   | ECR repository endpoint to use.                    | `ecr`                               |

charts/aws-vpc-cni/templates/daemonset.yaml

@@ -81,8 +81,13 @@ spec:
             timeoutSeconds: {{ .Values.readinessProbeTimeoutSeconds }}
           env:
 {{- range $key, $value := .Values.env }}
+  {{- $skipKey := and (eq $key "NETWORK_POLICY_ENFORCING_MODE") (not $.Values.nodeAgent.enabled) }}
+  {{- if not $skipKey }}
             - name: {{ $key }}
               value: {{ $value | quote }}
+  {{- else }}
+            # Skipping NETWORK_POLICY_ENFORCING_MODE because nodeAgent is disabled
+  {{- end }}
 {{- end }}
 {{- with .Values.extraEnv }}
       {{- toYaml .| nindent 12 }}

charts/aws-vpc-cni/values.yaml

@@ -8,7 +8,7 @@ nameOverride: aws-node
 
 init:
   image:
-    tag: v1.19.2
+    tag: v1.19.5
     domain: amazonaws.com
     region: us-west-2
     endpoint: ecr
@@ -27,7 +27,7 @@ init:
 nodeAgent:
   enabled: true
   image:
-    tag: v1.1.5
+    tag: v1.2.1
     domain: amazonaws.com
     region: us-west-2
     endpoint: ecr
@@ -46,13 +46,12 @@ nodeAgent:
   networkPolicyAgentLogFileLocation: "/var/log/aws-routed-eni/network-policy-agent.log"
   enableIpv6: "false"
   metricsBindAddr: "8162"
-  metricsBindPort: "8162"
   healthProbeBindAddr: "8163"
   conntrackCacheCleanupPeriod: 300
   resources: {}
 
 image:
-  tag: v1.19.2
+  tag: v1.19.5
   domain: amazonaws.com
   region: us-west-2
   endpoint: ecr
@@ -86,7 +85,7 @@ env:
   ENABLE_IPv4: "true"
   ENABLE_IPv6: "false"
   ENABLE_SUBNET_DISCOVERY: "true"
-  VPC_CNI_VERSION: "v1.19.2"
+  VPC_CNI_VERSION: "v1.19.5"
   NETWORK_POLICY_ENFORCING_MODE: "standard"
 
 # Add env from configMap or from secrets
@@ -245,4 +244,4 @@ podMonitor:
   # The timeout before a metrics scrape fails.
   scrapeTimeout: 30s
   # relabelings to apply to the podMonitor
-  relabelings: []
+  relabelings: []

charts/cni-metrics-helper/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: cni-metrics-helper
-version: 1.19.2
-appVersion: v1.19.2
+version: 1.19.5
+appVersion: v1.19.5
 description: A Helm chart for the AWS VPC CNI Metrics Helper
 icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png
 home: https://github.com/aws/amazon-vpc-cni-k8s

charts/cni-metrics-helper/README.md

@@ -60,7 +60,7 @@ The following table lists the configurable parameters for this chart and their d
 | -------------------------------|---------------------------------------------------------------|-------------------------------------|
 | `affinity`                     | Map of node/pod affinities                                    | `{}`                                |
 | `fullnameOverride`             | Override the fullname of the chart                            | `cni-metrics-helper`                |
-| `image.tag`                    | Image tag                                                     | `v1.19.2`                           |
+| `image.tag`                    | Image tag                                                     | `v1.19.5`                           |
 | `image.domain`                 | ECR repository domain                                         | `amazonaws.com`                     |
 | `image.region`                 | ECR repository region to use. Should match your cluster       | `us-west-2`                         |
 | `image.account`                | ECR repository account number                                 | `602401143452`                      |

charts/cni-metrics-helper/values.yaml

@@ -4,7 +4,7 @@ nameOverride: cni-metrics-helper
 
 image:
   region: us-west-2
-  tag: v1.19.2
+  tag: v1.19.5
   account: "602401143452"
   domain: "amazonaws.com"
   # Set to use custom image