STOR-2598: Rebase to upstream v2.1.11 for OCP 4.21

CHANGELOG-2.x.md

@@ -1,3 +1,15 @@
+# V2.1.11
+* Bump k8 version to default 1.33 for e2e tests([#1681](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1681), [@dankova22](https://github.com/dankova22))
+* Update openssl installation change in Dockerfile ([#1678](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1678), [@anthotse](https:///github.com/anthotse))
+* Fix spelling errors and modernize deprecated io/ioutil usage ([#1674](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1674), [@oyiz](https://github.com/oyuz))
+# V2.1.10
+* Update dependencies and fix go.sum ([#1663](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1663), [@anthotse](https://anthotse))
+* Implement ControllerModifyVolume function ([#1663](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1663), [@anthotse](https://anthotse))
+* Update golang in Dockerfile ([#1663](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1663), [@anthotse](https://anthotse)) 
+# V2.1.9
+* Fixing CVEs and depricated pod images ([#1649](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1649)), [@thakurmi](https://github.com/thakurmi)
+* unpinned openssl to fix failing build ([#1638](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1638)), [@thakurmi](https://github.com/thakurmi)
+* CVE-2025-22869: bump golang.org/x/crypto to v0.35.0 ([#1611](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1611)), [@kunalmemane](https://github.com/kunalmemane)
 # V2.1.8
 * Remove unused workflow that publishes images to dockerhub ([#1621](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1621), [@jrakas-dev](https://github.com/jrakas-dev))
 *  Return existing access point if one already exists during create workflow ([#1620](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1620), [@jrakas-dev](https://github.com/jrakas-dev))
@@ -82,4 +94,4 @@ Remove libwrap=no from stunnel config on startup for newer stunnel compatibility
 * Update go-restful dependency. ([#1308](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1308), [@RyanStan](https://github.com/RyanStan))
 * Adds script + instructions for an in-place upgrade test. ([#1304](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1304), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
 * Update test file manifest paths for e2e tests. ([#1303](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1303), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
-* Bump SIDECARS to the latest. ([#1302](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1302), [@mskanth972](https://github.com/mskanth972))
+* Bump SIDECARS to the latest. ([#1302](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1302), [@mskanth972](https://github.com/mskanth972))

Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM public.ecr.aws/eks-distro-build-tooling/golang:1.23.0 as go-builder
+FROM public.ecr.aws/eks-distro-build-tooling/golang:1.24.0 as go-builder
 WORKDIR /go/src/github.com/kubernetes-sigs/aws-efs-csi-driver
 
 ARG TARGETOS
@@ -63,7 +63,10 @@ COPY --from=rpm-provider /tmp/rpms/* /tmp/download/
 # cd, ls, cat, vim, tcpdump, are for debugging
 RUN clean_install amazon-efs-utils true && \
     clean_install crypto-policies true && \
-    clean_install "openssl-3.0.8 openssl-libs-3.0.8" true && \
+    # Remove existing OpenSSL packages and install version 3.0.8 packages. Newer OpenSSL version
+    # have an updated method of enabling fips, which we do not support yet.
+    remove_package "openssl openssl-libs openssl-fips-provider-latest" && \
+    clean_install "openssl-3.0.8 openssl-libs-3.0.8 openssl-fips-provider-certified-3.0.8" true && \
     install_binary \
         /usr/bin/cat \
         /usr/bin/cd \

Makefile

@@ -13,7 +13,7 @@
 # limitations under the License.
 #
 
-VERSION=v2.1.8
+VERSION=v2.1.11
 
 PKG=github.com/kubernetes-sigs/aws-efs-csi-driver
 GIT_COMMIT?=$(shell git rev-parse HEAD)
@@ -131,7 +131,7 @@ test-e2e:
 .PHONY: test-e2e-external-eks
 test-e2e-external-eks:
 	CLUSTER_TYPE=eksctl \
-	K8S_VERSION="1.25" \
+	K8S_VERSION="1.33" \
 	DRIVER_NAME=aws-efs-csi-driver \
 	HELM_VALUES_FILE="./hack/values_eksctl.yaml" \
 	CONTAINER_NAME=efs-plugin \

charts/aws-efs-csi-driver/CHANGELOG.md

@@ -1,4 +1,10 @@
 # Helm chart
+# v3.2.1
+* Bump app/driver version to `v2.1.10`
+# v3.2.0
+* Bump app/driver version to `v2.1.9`
+# v3.1.9
+* Bump app/driver version to `v2.1.8`
 # v3.1.8
 * Bump app/driver version to `v2.1.7`
 # v3.1.7

charts/aws-efs-csi-driver/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: aws-efs-csi-driver
-version: 3.1.8
-appVersion: 2.1.7
+version: 3.2.1
+appVersion: 2.1.10
 kubeVersion: ">=1.17.0-0"
 description: "A Helm chart for AWS EFS CSI Driver"
 home: https://github.com/kubernetes-sigs/aws-efs-csi-driver

charts/aws-efs-csi-driver/values.yaml

@@ -11,14 +11,14 @@ portRangeUpperBound: "21049"
 
 image:
   repository: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver
-  tag: "v2.1.7"
+  tag: "v2.1.10"
   pullPolicy: IfNotPresent
 
 sidecars:
   livenessProbe:
     image:
       repository: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe
-      tag: v2.14.0-eks-1-32-6
+      tag: v2.15.0-eks-1-33-3
       pullPolicy: IfNotPresent
     resources: {}
     securityContext:
@@ -27,7 +27,7 @@ sidecars:
   nodeDriverRegistrar:
     image:
       repository: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar
-      tag: v2.13.0-eks-1-32-6
+      tag: v2.13.0-eks-1-33-3
       pullPolicy: IfNotPresent
     resources: {}
     securityContext:
@@ -36,7 +36,7 @@ sidecars:
   csiProvisioner:
     image:
       repository: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner
-      tag: v5.2.0-eks-1-32-6
+      tag: v5.2.0-eks-1-33-3
       pullPolicy: IfNotPresent
     resources: {}
     securityContext:

deploy/kubernetes/base/controller-deployment.yaml

@@ -37,7 +37,7 @@ spec:
         - name: efs-plugin
           securityContext:
             privileged: true
-          image: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.7
+          image: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.10
           imagePullPolicy: IfNotPresent
           args:
             - --endpoint=$(CSI_ENDPOINT)
@@ -69,7 +69,7 @@ spec:
             periodSeconds: 10
             failureThreshold: 5
         - name: csi-provisioner
-          image: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-32-6
+          image: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.2.0-eks-1-33-3
           imagePullPolicy: IfNotPresent
           args:
             - --csi-address=$(ADDRESS)
@@ -87,7 +87,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: liveness-probe
-          image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-6
+          image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-3
           imagePullPolicy: IfNotPresent
           args:
             - --csi-address=/csi/csi.sock

deploy/kubernetes/base/node-daemonset.yaml

@@ -48,7 +48,7 @@ spec:
         - name: efs-plugin
           securityContext:
             privileged: true
-          image: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.7
+          image: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.10
           imagePullPolicy: IfNotPresent
           args:
             - --endpoint=$(CSI_ENDPOINT)
@@ -91,7 +91,7 @@ spec:
             periodSeconds: 2
             failureThreshold: 5
         - name: csi-driver-registrar
-          image: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-32-6
+          image: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.13.0-eks-1-33-3
           imagePullPolicy: IfNotPresent
           args:
             - --csi-address=$(ADDRESS)
@@ -115,7 +115,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: liveness-probe
-          image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-6
+          image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.15.0-eks-1-33-3
           imagePullPolicy: IfNotPresent
           args:
             - --csi-address=/csi/csi.sock

deploy/kubernetes/overlays/stable/ecr/kustomization.yaml

@@ -5,13 +5,13 @@ bases:
 images:
   - name: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver
     newName: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/aws-efs-csi-driver
-    newTag: v2.1.7
+    newTag: v2.1.10
   - name: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe
     newName: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/livenessprobe
-    newTag: v2.14.0-eks-1-32-6
+    newTag: v2.15.0-eks-1-33-3
   - name: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar
     newName: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/csi-node-driver-registrar
-    newTag: v2.13.0-eks-1-32-6
+    newTag: v2.13.0-eks-1-33-3
   - name: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner
     newName: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/csi-provisioner
-    newTag: v5.2.0-eks-1-32-6
+    newTag: v5.2.0-eks-1-33-3

deploy/kubernetes/overlays/stable/kustomization.yaml

@@ -4,10 +4,10 @@ bases:
   - ../../base
 images:
   - name: public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver
-    newTag: v2.1.7
+    newTag: v2.1.10
   - name: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe
-    newTag: v2.14.0-eks-1-32-6
+    newTag: v2.15.0-eks-1-33-3
   - name: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar
-    newTag: v2.13.0-eks-1-32-6
+    newTag: v2.13.0-eks-1-33-3
   - name: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner
-    newTag: v5.2.0-eks-1-32-6
+    newTag: v5.2.0-eks-1-33-3

docs/README.md

@@ -89,6 +89,9 @@ The following sections are Kubernetes specific. If you are a Kubernetes user, us
 | Amazon EFS CSI Driver Version | Image                            |
 |-------------------------------|----------------------------------|
 | master branch                 | amazon/aws-efs-csi-driver:master |
+| v2.1.11                       | amazon/aws-efs-csi-driver:v2.1.11|
+| v2.1.10                       | amazon/aws-efs-csi-driver:v2.1.10|
+| v2.1.9                        | amazon/aws-efs-csi-driver:v2.1.9 |
 | v2.1.8                        | amazon/aws-efs-csi-driver:v2.1.8 |
 | v2.1.7                        | amazon/aws-efs-csi-driver:v2.1.7 |
 | v2.1.6                        | amazon/aws-efs-csi-driver:v2.1.6 |
@@ -158,7 +161,7 @@ The following sections are Kubernetes specific. If you are a Kubernetes user, us
 ### ECR Image
 | Driver Version | [ECR](https://gallery.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver) Image |
 |----------------|-------------------------------------------------------------------------------|
-| v2.1.8         | public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.8                |
+| v2.1.11        | public.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver:v2.1.11               |
 
 **Note**  
 You can find previous efs-csi-driver versions' images from [here](https://gallery.ecr.aws/efs-csi-driver/amazon/aws-efs-csi-driver)
@@ -383,7 +386,7 @@ If you want to update to a specific version, first customize the driver yaml fil
 kubectl kustomize "github.com/kubernetes-sigs/aws-efs-csi-driver/deploy/kubernetes/overlays/stable/?ref=release-2.0" > driver.yaml
 ```
 
-Then, update all lines referencing `image: amazon/aws-efs-csi-driver` to the desired version (e.g., to `image: amazon/aws-efs-csi-driver:v2.1.8`) in the yaml file, and deploy driver yaml again:
+Then, update all lines referencing `image: amazon/aws-efs-csi-driver` to the desired version (e.g., to `image: amazon/aws-efs-csi-driver:v2.1.11`) in the yaml file, and deploy driver yaml again:
 ```sh
 kubectl apply -f driver.yaml
 ```

examples/kubernetes/access_points/specs/example.yaml

@@ -67,7 +67,7 @@ metadata:
 spec:
   containers:
   - name: app
-    image: centos:7
+    image: rockylinux:8
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo $(date -u) >> /data-dir1/out.txt; sleep 5; done"]
     volumeMounts:

examples/kubernetes/cross_account_mount/specs/pod-static-prov.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: app
-    image: centos:7
+    image: rockylinux:8
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo $(date -u) >> /data/out.txt; sleep 5; done"]
     volumeMounts:

examples/kubernetes/cross_account_mount/specs/pod.yaml

@@ -18,7 +18,7 @@ metadata:
 spec:
   containers:
     - name: app
-      image: centos:7
+      image: rockylinux:8
       command: ["/bin/sh"]
       args: ["-c", "while true; do echo $(date -u) >> /data/out; sleep 5; done"]
       volumeMounts:

examples/kubernetes/dynamic_provisioning/specs/pod.yaml

@@ -18,7 +18,7 @@ metadata:
 spec:
   containers:
     - name: app
-      image: centos:7
+      image: rockylinux:8
       command: ["/bin/sh"]
       args: ["-c", "while true; do echo $(date -u) >> /data/out; sleep 5; done"]
       volumeMounts:

examples/kubernetes/encryption_in_transit/specs/pod.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: app
-    image: centos:7
+    image: rockylinux:8
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo $(date -u) >> /data/out.txt; sleep 5; done"]
     volumeMounts:

examples/kubernetes/static_provisioning/specs/pod.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: app
-    image: centos:7
+    image: rockylinux:8
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo $(date -u) >> /data/out.txt; sleep 5; done"]
     volumeMounts:

examples/kubernetes/volume_path/specs/example.yaml

@@ -71,7 +71,7 @@ metadata:
 spec:
   containers:
   - name: app
-    image: centos:7
+    image: rockylinux:8
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo $(date -u) >> /data-dir1/out.txt; sleep 5; done"]
     volumeMounts: