Skip to content

fix: Regionalize all container images in UseRegionalImage() #8744

Merged
michaelhtm merged 2 commits into
eksctl-io:mainfrom
sapphirew:fix/regionalize-all-containers
May 13, 2026
Merged

fix: Regionalize all container images in UseRegionalImage() #8744
michaelhtm merged 2 commits into
eksctl-io:mainfrom
sapphirew:fix/regionalize-all-containers

Conversation

@sapphirew
Copy link
Copy Markdown
Contributor

@sapphirew sapphirew commented May 12, 2026

Description

UseRegionalImage() only processed Containers[0] and InitContainers[0], missing the aws-eks-nodeagent container introduced in VPC CNI v1.14.0. This caused the nodeagent image to retain the default us-west-2 ECR URI on clusters in other regions when using eksctl utils update-aws-node.

Changes:

  • UseRegionalImage() now iterates over all containers and init containers
  • Added isRegionalImageFormat() guard to skip already-resolved URIs
  • UpdateAWSNode() sets the image format prefix for aws-eks-nodeagent by name before calling UseRegionalImage()
  • Added awsNodeAgentImageFormatPrefix constant

Testing

Unit tests

  • Added pkg/addons/image_test.go covering UseRegionalImage() with multiple containers, mixed format-string/resolved images, Chinese regions (.amazonaws.com.cn suffix), and empty init container slices.
  • Updated pkg/addons/default/aws_node_test.go to assert Containers[1] (aws-eks-nodeagent) is regionalized in both standard (us-east-1) and Chinese (cn-northwest-1) region test cases.

Live cluster verification (eu-west-1)

  1. Created a new EKS cluster (regionalize-test) in eu-west-1 with one self-managed node.
  2. Deleted the managed vpc-cni addon with --preserve to convert to self-managed VPC CNI.
  3. Simulated the bug by manually setting the nodeagent image to us-west-2:
    aws-node:          602401143452.dkr.ecr.eu-west-1.amazonaws.com/amazon-k8s-cni:v1.20.5-eksbuild.1
    aws-eks-nodeagent: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-network-policy-agent:v1.2.7-eksbuild.2  ← wrong region
    
  4. Ran eksctl utils update-aws-node --cluster regionalize-test --region eu-west-1 --approve with the patched binary.
  5. Verified all images were correctly regionalized to eu-west-1:
    aws-node:          602401143452.dkr.ecr.eu-west-1.amazonaws.com/amazon-k8s-cni:v1.21.1
    aws-eks-nodeagent: 602401143452.dkr.ecr.eu-west-1.amazonaws.com/amazon/aws-network-policy-agent:v1.3.1  ← fixed
    aws-vpc-cni-init:  602401143452.dkr.ecr.eu-west-1.amazonaws.com/amazon-k8s-cni-init:v1.21.1
    
  6. Confirmed pod was 2/2 Running — both containers pulling successfully from the correct regional ECR.

Checklist

  • Added tests that cover your change (if possible)
  • Added/modified documentation as required (such as the README.md, or the userdocs directory)
  • Manually tested
  • Made sure the title of the PR is a good description that can go into the release notes
  • (Core team) Added labels for change area (e.g. area/nodegroup) and kind (e.g. kind/improvement)

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

  • Backfilled missing tests for code in same general area 🎉
  • Refactored something and made the world a better place 🌟

UseRegionalImage() only processed Containers[0] and InitContainers[0],
missing the aws-eks-nodeagent container introduced in VPC CNI v1.14.0.
This caused the nodeagent image to retain the default us-west-2 ECR URI
on clusters in other regions when using `eksctl utils update-aws-node`.

Changes:
- UseRegionalImage() now iterates over all containers and init containers
- Added isRegionalImageFormat() guard to skip already-resolved URIs
- UpdateAWSNode() sets the image format prefix for aws-eks-nodeagent by
  name before calling UseRegionalImage()
- Added awsNodeAgentImageFormatPrefix constant
- Add image_test.go covering UseRegionalImage() with multiple containers,
  mixed format-string/resolved images, Chinese regions, and no init
  containers
- Update aws_node_test.go to assert that Containers[1] (aws-eks-nodeagent)
  is correctly regionalized in both standard and Chinese region cases
@sapphirew sapphirew force-pushed the fix/regionalize-all-containers branch from 7374696 to 2732252 Compare May 13, 2026 00:14
@michaelhtm michaelhtm merged commit 9d4ad16 into eksctl-io:main May 13, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants