Add k8s-1.35 and ecr-credential-provider-1.35 pkgs with pre-release sources

Cargo.toml

@@ -35,6 +35,7 @@ members = [
   "packages/ecr-credential-provider-1.32",
   "packages/ecr-credential-provider-1.33",
   "packages/ecr-credential-provider-1.34",
+  "packages/ecr-credential-provider-1.35",
   "packages/ecs-agent",
   "packages/ecs-gpu-init",
   "packages/ethtool",
@@ -56,6 +57,7 @@ members = [
   "packages/kubernetes-1.32",
   "packages/kubernetes-1.33",
   "packages/kubernetes-1.34",
+  "packages/kubernetes-1.35",
   "packages/libacl",
   "packages/libaio",
   "packages/libattr",

kits/bottlerocket-core-kit/Cargo.toml

@@ -44,6 +44,7 @@ ecr-credential-provider-1_31 = { path = "../../packages/ecr-credential-provider-
 ecr-credential-provider-1_32 = { path = "../../packages/ecr-credential-provider-1.32" }
 ecr-credential-provider-1_33 = { path = "../../packages/ecr-credential-provider-1.33" }
 ecr-credential-provider-1_34 = { path = "../../packages/ecr-credential-provider-1.34" }
+ecr-credential-provider-1_35 = { path = "../../packages/ecr-credential-provider-1.35" }
 ecs-agent = { path = "../../packages/ecs-agent" }
 ecs-gpu-init = { path = "../../packages/ecs-gpu-init" }
 ethtool = { path = "../../packages/ethtool" }
@@ -65,6 +66,7 @@ kubernetes-1_31 = { path = "../../packages/kubernetes-1.31" }
 kubernetes-1_32 = { path = "../../packages/kubernetes-1.32" }
 kubernetes-1_33 = { path = "../../packages/kubernetes-1.33" }
 kubernetes-1_34 = { path = "../../packages/kubernetes-1.34" }
+kubernetes-1_35 = { path = "../../packages/kubernetes-1.35" }
 libacl = { path = "../../packages/libacl" }
 libaio = { path = "../../packages/libaio" }
 libattr = { path = "../../packages/libattr" }

packages/ecr-credential-provider-1.35/0001-ecr-credential-provider-hardcode-ECR-endpoint-for-eu.patch

@@ -0,0 +1,31 @@
+From 99df7b5980be2e66d2bbb32b405d24e0d64dbe85 Mon Sep 17 00:00:00 2001
+From: Sam Berning <bernings@amazon.com>
+Date: Fri, 7 Nov 2025 02:21:18 +0000
+Subject: [PATCH] ecr-credential-provider: hardcode ECR endpoint for
+ eusc-de-east-1
+
+Signed-off-by: Sam Berning <bernings@amazon.com>
+---
+ cmd/ecr-credential-provider/main.go | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
+index b61bd789..15642223 100644
+--- a/cmd/ecr-credential-provider/main.go
++++ b/cmd/ecr-credential-provider/main.go
+@@ -75,7 +75,11 @@ func defaultECRProvider(ctx context.Context, region string) (ECR, error) {
+ 		return nil, err
+ 	}
+
+-	return ecr.NewFromConfig(cfg), nil
++	return ecr.NewFromConfig(cfg, func(o *ecr.Options) {
++		if region == "eusc-de-east-1" {
++			o.BaseEndpoint = aws.String("https://api.ecr.eusc-de-east-1.amazonaws.eu")
++		}
++	}), nil
+ }
+
+ func publicECRProvider(ctx context.Context) (ECRPublic, error) {
+-- 
+2.42.0
+

packages/ecr-credential-provider-1.35/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+# "." is not allowed in crate names, but we want a friendlier name for the
+# directory and spec file, so we override it below.
+name = "ecr-credential-provider-1_35"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+
+[lib]
+path = "../packages.rs"
+
+[package.metadata.build-package]
+package-name = "ecr-credential-provider-1.35"
+releases-url = "https://github.com/kubernetes/cloud-provider-aws/releases"
+
+[[package.metadata.build-package.external-files]]
+url = "https://github.com/kubernetes/cloud-provider-aws/archive/refs/tags/v1.35.0.tar.gz"
+sha512 = "c98d0a734b5f0e643fbc0f37558182e89e6fbf0c882abab9a85de50cf5b0fc7e054228e440f8cf7ed3970da4d944e2ca1005d67ccd1f13cdb4574c502c49f45b"
+path = "cloud-provider-aws-1.35.0.tar.gz"
+bundle-modules = [ "go" ]
+
+[build-dependencies]
+glibc = { path = "../glibc" }

packages/ecr-credential-provider-1.35/clarify.toml

@@ -0,0 +1,5 @@
+[clarify."sigs.k8s.io/yaml"]
+expression = "MIT AND BSD-3-Clause AND Apache-2.0"
+license-files = [
+    { path = "LICENSE", hash = 0x617d80bc },
+]

packages/ecr-credential-provider-1.35/ecr-credential-provider-1.35.spec

@@ -0,0 +1,82 @@
+%global goproject github.com/kubernetes
+%global gorepo cloud-provider-aws
+%global goimport %{goproject}/%{gorepo}
+
+%global gover 1.35.0
+%global rpmver 1.35.0
+
+%global _dwz_low_mem_die_limit 0
+
+Name: %{_cross_os}ecr-credential-provider-1.35
+Version: %{rpmver}
+Release: 1%{?dist}
+Summary: Amazon ECR credential provider
+License: Apache-2.0
+URL: https://github.com/kubernetes/cloud-provider-aws
+
+Source: cloud-provider-aws-%{gover}.tar.gz
+Source1: bundled-cloud-provider-aws-%{gover}.tar.gz
+Source1000: clarify.toml
+
+Patch0001: 0001-ecr-credential-provider-hardcode-ECR-endpoint-for-eu.patch
+
+BuildRequires: %{_cross_os}glibc-devel
+Requires: %{name}(binaries)
+
+# For IAM Roles Anywhere, the signing helper might be set as the credential
+# process.
+Requires: %{_cross_os}aws-signing-helper
+
+%description
+%{summary}.
+
+%package bin
+Summary: Amazon ECR credential provider binaries
+Provides: %{name}(binaries)
+Requires: (%{_cross_os}image-feature(no-fips) and %{name})
+Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)
+
+%description bin
+%{summary}.
+
+%package fips-bin
+Summary: Amazon ECR credential provider binaries, FIPS edition
+Provides: %{name}(binaries)
+Requires: (%{_cross_os}image-feature(fips) and %{name})
+Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)
+
+%description fips-bin
+%{summary}.
+
+%prep
+%autosetup -Sgit -n %{gorepo}-%{gover} -p1
+%setup -T -D -n %{gorepo}-%{gover} -b 1 -q
+
+%build
+%set_cross_go_flags
+
+export GOTOOLCHAIN=local
+export GO_MAJOR="1.25"
+
+go build -ldflags="${GOLDFLAGS}" -o=ecr-credential-provider cmd/ecr-credential-provider/*.go
+gofips build -ldflags="${GOLDFLAGS}" -o=fips/ecr-credential-provider cmd/ecr-credential-provider/*.go
+
+%install
+install -d %{buildroot}%{_cross_libexecdir}/kubernetes/kubelet/plugins
+install -p -m 0755 ecr-credential-provider %{buildroot}%{_cross_libexecdir}/kubernetes/kubelet/plugins
+
+install -d %{buildroot}%{_cross_fips_libexecdir}/kubernetes/kubelet/plugins
+install -p -m 0755 fips/ecr-credential-provider %{buildroot}%{_cross_fips_libexecdir}/kubernetes/kubelet/plugins
+
+%cross_scan_attribution --clarify %{S:1000} go-vendor vendor
+
+%files
+%license LICENSE
+%{_cross_attribution_file}
+%{_cross_attribution_vendor_dir}
+
+%files bin
+%{_cross_libexecdir}/kubernetes/kubelet/plugins/ecr-credential-provider
+
+%files fips-bin
+%{_cross_fips_libexecdir}/kubernetes/kubelet/plugins/ecr-credential-provider

packages/kubernetes-1.35/.gitignore

@@ -0,0 +1 @@
+/*-EKS-PATCH-*.patch

packages/kubernetes-1.35/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+# "." is not allowed in crate names, but we want a friendlier name for the
+# directory and spec file, so we override it below.
+name = "kubernetes-1_35"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+
+[lib]
+path = "../packages.rs"
+
+[package.metadata.build-package]
+package-name = "kubernetes-1.35"
+
+[[package.metadata.build-package.external-files]]
+url = "https://distro.eks.amazonaws.com/kubernetes-1-35/releases/1/artifacts/kubernetes/v1.35.0-beta.0/kubernetes-src.tar.gz"
+sha512 = "7cd2aa9569e5a70ff7c5ee6048dda768823d6185eeb6946e00a322766f9ff9a6ad9cb70a56c712ee7486b4dbf9125cee6e08b15ba718e871c416a45a29219108"
+
+[build-dependencies]
+glibc = { path = "../glibc" }

packages/kubernetes-1.35/clarify.toml

@@ -0,0 +1,69 @@
+[clarify."github.com/JeffAshton/win_pdh"]
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "LICENSE", hash = 0xb221dcc9 },
+]
+
+[clarify."github.com/daviddengcn/go-colortext"]
+expression = "BSD-3-Clause AND MIT"
+license-files = [
+    { path = "LICENSE", hash = 0x9769fae1 },
+]
+
+[clarify."github.com/ghodss/yaml"]
+expression = "MIT AND BSD-3-Clause"
+license-files = [
+    { path = "LICENSE", hash = 0xcdf3ae00 },
+]
+
+[clarify."github.com/heketi/heketi"]
+# kubernetes only uses code that is under LGPLv3+/Apache 2.0, not the code that is GPLv2+/LGPLv3+
+expression = "LGPL-3.0-or-later OR Apache-2.0"
+license-files = [
+    { path = "LICENSE", hash = 0x3c4b96d1 },
+    { path = "LICENSE-APACHE2", hash = 0x438c8616 },
+    { path = "COPYING-LGPLV3", hash = 0xf0bccb3a },
+]
+skip-files = [ "COPYING-GPLV2" ]
+
+[clarify."github.com/go-bindata/go-bindata"]
+expression = "CC0-1.0"
+license-files = [
+    { path = "LICENSE", hash = 0x393fafd6 },
+]
+
+[clarify."github.com/miekg/dns"]
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "COPYRIGHT", hash = 0xe41dd36c },
+    { path = "LICENSE", hash = 0xfc8f12ff },
+]
+
+[clarify."sigs.k8s.io/yaml"]
+expression = "MIT AND BSD-3-Clause AND Apache-2.0"
+license-files = [
+    { path = "LICENSE", hash = 0x617d80bc },
+]
+
+[clarify."honnef.co/go/tools"]
+expression = "MIT AND BSD-3-Clause AND Apache-2.0"
+license-files = [
+    { path = "LICENSE", hash = 0xad378ed2 },
+    { path = "LICENSE-THIRD-PARTY", hash = 0x546425eb },
+    { path = "lint/LICENSE", hash = 0xc6b58232 },
+    { path = "ssa/LICENSE", hash = 0xe656fb62 },
+]
+
+[clarify."github.com/storageos/go-api"]
+expression = "MIT AND BSD-2-Clause"
+license-files = [
+    { path = "LICENCE", hash = 0x67a6861e },
+]
+skip-files = ["licence.go", "types/licence.go"]
+
+[clarify."github.com/grpc-ecosystem/go-grpc-middleware/v2"]
+expression = "Apache-2.0"
+license-files = [
+    { path = "COPYRIGHT", hash = 0x4bba7b1 },
+    { path = "LICENSE", hash = 0x6a39c900 },
+]

packages/kubernetes-1.35/credential-provider-config-yaml

@@ -0,0 +1,42 @@
+[required-extensions]
+aws = { version = "v1", optional = true }
+kubernetes  = "v1"
+std = { version = "v1", helpers = ["default"] }
++++
+apiVersion: kubelet.config.k8s.io/v1
+kind: CredentialProviderConfig
+providers:
+{{#if settings.kubernetes.credential-providers}}
+{{#each settings.kubernetes.credential-providers}}
+{{#if this.enabled}}
+  - name: {{@key}}
+    matchImages:
+{{#each this.image-patterns}}
+      - "{{this}}"
+{{/each}}
+    defaultCacheDuration: "{{default "12h" this.cache-duration}}"
+    apiVersion: credentialprovider.kubelet.k8s.io/v1
+{{#if (eq @key "ecr-credential-provider")}}
+    env:
+{{else}}
+{{#if this.environment}}
+    env:
+{{/if}}
+{{/if}}
+{{#if this.environment}}
+{{#each this.environment}}
+      - name: {{@key}}
+        value: '{{this}}'
+{{/each}}
+{{/if}}
+{{#if (eq @key "ecr-credential-provider")}}
+      - name: HOME
+        value: '/root'
+{{#if @root.settings.aws.profile}}
+      - name: AWS_PROFILE
+        value: '{{@root.settings.aws.profile}}'
+{{/if}}
+{{/if}}
+{{/if}}
+{{/each}}
+{{/if}}

packages/kubernetes-1.35/dockershim-symlink.conf

@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=/bin/ln -sf ./containerd/containerd.sock /run/dockershim.sock

packages/kubernetes-1.35/etc-kubernetes-pki-private.mount

@@ -0,0 +1,16 @@
+[Unit]
+Description=Kubernetes PKI private directory (/etc/kubernetes/pki/private)
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target
+After=selinux-policy-files.service
+Wants=selinux-policy-files.service
+
+[Mount]
+What=tmpfs
+Where=/etc/kubernetes/pki/private
+Type=tmpfs
+Options=nosuid,nodev,noexec,noatime,context=system_u:object_r:etc_secret_t:s0,mode=0700
+
+[Install]
+WantedBy=preconfigured.target