[ACTION REQUIRED] Downgrade amazon-k8s-cni images to 1.21.1

TL;DR: Chainguard is withdrawing the amazon-k8s-cni and amazon-k8s-cni-init images at version 1.22.

What is changing?

Chainguard is withdrawing the amazon-k8s-cni and amazon-k8s-cni-init images (and FIPS versions) at version 1.22. We have already reverted the latest tag to point at 1.21.1. So, if you were using :latest, you may notice the version number goes back to 1.21.1.

Why is Chainguard making this change?

The amazon-k8s-cni repository created a 1.22 tag, but did not release an image. The upstream 1.22 version is not yet code complete and may not work. 

However, our automation detected the new branch and built the 1.22 version. We have adjusted the automation to only detect fully released builds in the future.

How will this affect me?

If you currently reference amazon-k8s-cni:1.22, you will be unable to deploy new clusters after this image is withdrawn. To avoid deployment failures, update your configuration to use the AWS-provided default version 1.21.1 before the withdrawal date.

What do I need to do?

If you are using the 1.22 images, we recommend you adjust your helm values to specify 1.21.1 and run a “helm upgrade”. If you are using “latest” it should already have automatically reverted to the 1.21.1 image.

FAQs

When is the “real” 1.22 version coming?

Due to the notice period for this change and the unpredictable release cycle, AWS may release the 1.22 image before the scheduled withdrawal date. If this happens, we will release the official 1.22.0 image with a higher epoch number (eg 1.22.0-r1).

What about CVEs in the 1.21.1 image?

We stopped building 1.21.1, so it temporarily accrued some CVEs, which we have now remediated. We will continue to support 1.21.1 until 1.22 is released.

How would I know if I’m using 1.22?

You would have intentionally set the version to 1.22 in your helm values. The amazon-k8s-cni:1.22 image is not in any official AWS helm charts yet, so you are unlikely to be using it. There are no features that should require this image version yet, and the 1.21.1 version should be used instead.

Need help or have questions?

We're here to help - visit our support portal at support.chainguard.dev.

- Chainguard Team