aws-vpc-cni
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for aws-vpc-cni.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
# This default name override is to maintain backwards compatability with
6
# existing naming
7
nameOverride: aws-node
8
init:
9
image:
10
tag: 1.23.0@sha256:b33a664a348a109b4db14a3f2775dfab73fb953b8f063a62d4a845dcea618875
11
domain: amazonaws.com
12
region: us-west-2
13
endpoint: ecr
14
account: "602401143452"
15
pullPolicy: IfNotPresent
16
# Set to use custom image
17
overrideRepository:
18
# overrideRepository: "repo/org/image"
19
override:
20
# override: "repo/org/image:tag"
21
repository: cgr.dev/chainguard-private/amazon-k8s-cni-init-fips
22
env:
23
DISABLE_TCP_EARLY_DEMUX: "false"
24
ENABLE_IPv6: "false"
25
securityContext:
26
privileged: true
27
resources: {}
28
nodeAgent:
29
enabled: true
30
image:
31
tag: 1.4.2@sha256:fbbd09b8547ab5e2988e171dc1f8e5b923a307229f938dcc3d5c19c3358bd9d0
32
domain: amazonaws.com
33
region: us-west-2
34
endpoint: ecr
35
account: "602401143452"
36
pullPolicy: IfNotPresent
37
# Set to use custom image
38
overrideRepository:
39
# overrideRepository: "repo/org/image"
40
override:
41
# override: "repo/org/image:tag"
42
repository: cgr.dev/chainguard-private/aws-network-policy-agent-fips
43
securityContext:
44
capabilities:
45
add:
46
- "NET_ADMIN"
47
privileged: true
48
enableCloudWatchLogs: "false"
49
enablePolicyEventLogs: "false"
50
networkPolicyAgentLogFileLocation: "/var/log/aws-routed-eni/network-policy-agent.log"
51
enableIpv6: "false"
52
metricsBindAddr: "8162"
53
healthProbeBindAddr: "8163"
54
conntrackCacheCleanupPeriod: 300
55
conntrackCacheTableSize: 524288
56
logLevel: "debug"
57
resources: {}
58
image:
59
tag: 1.23.0@sha256:2e0fcee8ae4a5efe64dba83d0695ebb6b09c85f7d2ce561afd2731eaea3a6814
60
domain: amazonaws.com
61
region: us-west-2
62
endpoint: ecr
63
account: "602401143452"
64
pullPolicy: IfNotPresent
65
# Set to use custom image
66
overrideRepository:
67
# overrideRepository: "repo/org/image"
68
override:
69
# override: "repo/org/image:tag"
70
repository: cgr.dev/chainguard-private/amazon-k8s-cni-fips
71
# The CNI supports a number of environment variable settings
72
# See https://github.com/aws/amazon-vpc-cni-k8s#cni-configuration-variables
73
env:
74
ADDITIONAL_ENI_TAGS: "{}"
75
AWS_VPC_CNI_NODE_PORT_SUPPORT: "true"
76
AWS_VPC_ENI_MTU: "9001"
77
AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG: "false"
78
AWS_VPC_K8S_CNI_EXTERNALSNAT: "false"
79
AWS_VPC_K8S_CNI_LOG_FILE: "/host/var/log/aws-routed-eni/ipamd.log"
80
AWS_VPC_K8S_CNI_LOGLEVEL: DEBUG
81
AWS_VPC_K8S_CNI_RANDOMIZESNAT: "prng"
82
AWS_VPC_K8S_CNI_VETHPREFIX: eni
83
AWS_VPC_K8S_PLUGIN_LOG_FILE: "/var/log/aws-routed-eni/plugin.log"
84
AWS_VPC_K8S_PLUGIN_LOG_LEVEL: DEBUG
85
DISABLE_INTROSPECTION: "false"
86
DISABLE_METRICS: "false"
87
ENABLE_POD_ENI: "false"
88
ENABLE_PREFIX_DELEGATION: "false"
89
WARM_ENI_TARGET: "1"
90
WARM_PREFIX_TARGET: "1"
91
DISABLE_NETWORK_RESOURCE_PROVISIONING: "false"
92
ENABLE_IPv4: "true"
93
ENABLE_IPv6: "false"
94
ENABLE_SUBNET_DISCOVERY: "true"
95
VPC_CNI_VERSION: "v1.22.4"
96
NETWORK_POLICY_ENFORCING_MODE: "standard"
97
ENABLE_IMDS_ONLY_MODE: "false"
98
ENABLE_MULTI_NIC: "false"
99
# Add env from configMap or from secrets
100
# - name: ENV_VAR1
101
# valueFrom:
102
# configMapKeyRef:
103
# name: example-config
104
# key: ENV_VAR1
105
# - name: ENV_VAR2
106
# valueFrom:
107
# configMapKeyRef:
108
# name: example-config
109
# key: ENV_VAR2
110
# - name: SECRET_VAR1
111
# valueFrom:
112
# secretKeyRef:
113
# name: example-secret
114
# key: SECRET_VAR1
115
extraEnv: []
116
# this flag enables you to use the match label that was present in the original daemonset deployed by EKS
117
# You can then annotate and label the original aws-node resources and 'adopt' them into a helm release
118
originalMatchLabels: false
119
# Settings for aws-vpc-cni ConfigMap
120
# - Network Policy settings
121
enableNetworkPolicy: "false"
122
# - Windows settings
123
enableWindowsIpam: "false"
124
# - Windows Prefix Delegation settings
125
enableWindowsPrefixDelegation: "false"
126
warmWindowsPrefixTarget: 0
127
warmWindowsIPTarget: 1
128
minimumWindowsIPTarget: 3
129
# - Security Groups for Pods settings
130
branchENICooldown: 60
131
cniConfig:
132
enabled: false
133
fileContents: ""
134
imagePullSecrets: []
135
fullnameOverride: "aws-node"
136
priorityClassName: system-node-critical
137
podSecurityContext: {}
138
podAnnotations: {}
139
podLabels: {}
140
securityContext:
141
capabilities:
142
add:
143
- "NET_ADMIN"
144
- "NET_RAW"
145
serviceAccount:
146
# Specifies whether a service account should be created
147
create: true
148
# The name of the service account to use.
149
# If not set and create is true, a name is generated using the fullname template
150
name: aws-vpc-cni-sa
151
annotations: {}
152
# To set annotations - serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::<AWS_ACCOUNT_ID>:<IAM_ROLE_NAME>
153
livenessProbe:
154
exec:
155
command:
156
- /app/grpc-health-probe
157
- '-addr=:50051'
158
- '-connect-timeout=5s'
159
- '-rpc-timeout=5s'
160
initialDelaySeconds: 60
161
livenessProbeTimeoutSeconds: 10
162
readinessProbe:
163
exec:
164
command:
165
- /app/grpc-health-probe
166
- '-addr=:50051'
167
- '-connect-timeout=5s'
168
- '-rpc-timeout=5s'
169
initialDelaySeconds: 1
170
readinessProbeTimeoutSeconds: 10
171
resources:
172
requests:
173
cpu: 25m
174
updateStrategy:
175
type: RollingUpdate
176
rollingUpdate:
177
maxUnavailable: "10%"
178
nodeSelector: {}
179
tolerations:
180
- operator: Exists
181
affinity:
182
nodeAffinity:
183
requiredDuringSchedulingIgnoredDuringExecution:
184
nodeSelectorTerms:
185
- matchExpressions:
186
- key: "kubernetes.io/os"
187
operator: In
188
values:
189
- linux
190
- key: "kubernetes.io/arch"
191
operator: In
192
values:
193
- amd64
194
- arm64
195
- key: "eks.amazonaws.com/compute-type"
196
operator: NotIn
197
values:
198
- fargate
199
- hybrid
200
- auto
201
eniConfig:
202
# Specifies whether ENIConfigs should be created
203
create: false
204
region: us-west-2
205
subnets:
206
# Key identifies the AZ
207
# Value contains the subnet ID and security group IDs within that AZ
208
# us-west-2a:
209
# id: subnet-123
210
# securityGroups:
211
# - sg-123
212
# us-west-2b:
213
# id: subnet-456
214
# securityGroups:
215
# - sg-456
216
# us-west-2c:
217
# id: subnet-789
218
# securityGroups:
219
# - sg-789
220
podMonitor:
221
# Create Prometheus podMonitor
222
create: false
223
# Annotations to add to the Prometheus podMonitor
224
annotations: {}
225
# Labels to add to the Prometheus podMonitor
226
labels: {}
227
# The interval to scrape metrics.
228
interval: 30s
229
# The timeout before a metrics scrape fails.
230
scrapeTimeout: 30s
231
# relabelings to apply to the podMonitor
232
relabelings: []
233
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.