Ensure Latest Cni Version Is Used

# 1) Identify current CNI DaemonSet and version
# Run on: any machine with kubectl access

kubectl -n kube-system get daemonset \
  -o custom-columns='NAMESPACE:{metadata.namespace},NAME:{metadata.name},IMAGE:{.spec.template.spec.containers[*].image}' \
  | grep -iE 'cni|aws-node|calico|weave|cilium'

# 2) Get detailed spec of the CNI DaemonSet
# Run on: any machine with kubectl access

kubectl -n kube-system get daemonset aws-node -o yaml

# 3) Check CNI pod versions actually running on nodes
# Run on: any machine with kubectl access

kubectl -n kube-system get pods -o wide | grep -i 'aws-node'
kubectl -n kube-system get pods -l k8s-app=aws-node -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}'

# 4) Correlate node EKS/Kubernetes version with CNI image
# Run on: any machine with kubectl access

kubectl get nodes -o wide

# 5) Inspect CNI network artifacts on nodes (evidence gathering only)
# Run on: any worker node via SSH (NOT via kubectl)

sudo ls -R /var/lib/cni/networks
sudo cat /var/log/aws-routed-eni/ipamd.log | head -n 50

#!/usr/bin/env bash
# Purpose: Report AWS VPC CNI plugin version usage across the cluster
# Runs on: any machine with kubectl access and aws CLI (optional for latest lookup)
# Requires: kubectl configured with cluster-admin or equivalent RBAC

set -euo pipefail

echo "=== 1) Detecting AWS VPC CNI daemonset and image versions (kube-system, aws-node) ==="
kubectl get ds aws-node -n kube-system -o wide || {
  echo "aws-node DaemonSet not found in kube-system namespace."
  echo "If you use a different CNI, this specific check does not apply."
}

echo
echo "--- DaemonSet spec images (what should be running) ---"
kubectl get ds aws-node -n kube-system -o jsonpath='{range .spec.template.spec.containers[*]}{.name}{"\t"}{.image}{"\n"}{end}' 2>/dev/null || true
echo

echo "--- Pods' actual images per node (what is running) ---"
kubectl get pods -n kube-system -l "k8s-app=aws-node" -o wide 2>/dev/null || true
echo
kubectl get pods -n kube-system -l "k8s-app=aws-node" -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.hostIP}{"\t"}{range .spec.containers[*]}{.name}{"="}{.image}{" "}{end}{"\n"}{end}' 2>/dev/null || true
echo

echo "=== 2) Extracting aws-node CNI image tags (from DaemonSet) ==="
DS_IMAGES=$(kubectl get ds aws-node -n kube-system -o jsonpath='{range .spec.template.spec.containers[*]}{.image}{"\n"}{end}' 2>/dev/null || true)
if [ -z "$DS_IMAGES" ]; then
  echo "No images found on aws-node DaemonSet. Check if another CNI is in use."
else
  echo "$DS_IMAGES" | sort -u | while read -r img; do
    [ -z "$img" ] && continue
    repo="${img%:*}"
    tag="${img##*:}"
    if [ "$repo" = "$tag" ]; then
      # no explicit tag -> implicitly 'latest' or digest-only
      echo "Image: $img"
      if [[ "$img" == *@* ]]; then
        echo "  -> Image uses a digest (immutable). Check EKS/AWS docs to identify its version."
      else
        echo "  -> Image has no tag; Kubernetes will treat it as ':latest'. Verify this is the desired latest CNI release."
      fi
    else
      echo "Image: $img"
      echo "  -> Parsed tag: $tag"
    fi
  done
fi
echo

echo "=== 3) Correlate CNI versions with EKS/Kubernetes versions (cluster-wide) ==="
echo "--- Cluster version info ---"
kubectl version -o yaml
echo

echo "=== 4) (Optional) Compare against latest AWS CNI release from GitHub ==="
if command -v curl >/dev/null 2>&1; then
  echo "Querying latest aws-node CNI release tag from GitHub..."
  LATEST_GH_TAG=$(curl -s https://api.github.com/repos/aws/amazon-vpc-cni-k8s/releases/latest | \
                  grep '"tag_name"' | head -n1 | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/' || true)
  if [ -n "$LATEST_GH_TAG" ]; then
    echo "Latest GitHub release tag: $LATEST_GH_TAG"
    echo "Compare this tag with the image tags reported above."
  else
    echo "Could not determine latest tag from GitHub API. Review manually:"
    echo "  https://github.com/aws/amazon-vpc-cni-k8s/releases"
  fi
else
  echo "curl not installed; cannot auto-query GitHub releases."
  echo "Manually review latest version at:"
  echo "  https://github.com/aws/amazon-vpc-cni-k8s/releases"
fi
echo

echo "=== 5) Node-level CNI binaries/networks (for spot checks) ==="
echo "Note: Access to node shells is required for this part."
echo "Example commands to run on a worker node (not executed here):"
cat <<'EOF'
# On a worker node (SSH session):

# List CNI binaries and versions (if versioned or with --version support)
ls -l /opt/cni/bin
for bin in /opt/cni/bin/*; do
  "$bin" --version 2>/dev/null || true
done

# Check existing CNI network allocations
ls -R /var/lib/cni/networks
EOF
echo

echo "=== INTERPRETING RESULTS ==="
cat <<'EOF'
Potential problems indicated by this report:

1. aws-node DaemonSet missing:
   - If you expect to use AWS VPC CNI and the DaemonSet is absent, the cluster may be using a different CNI or is misconfigured.

2. Image tags clearly behind latest:
   - If the aws-node image tags (e.g. 1.11.x) are older than the latest release tag reported from GitHub or AWS EKS documentation for your cluster version,
     the CNI is not at the latest supported version.

3. Mixed CNI versions across nodes:
   - If 'kubectl get pods -n kube-system -l k8s-app=aws-node -o jsonpath=...' shows different image tags on different nodes,
     the cluster is in a partially upgraded state; ensure upgrade completes on all nodes.

4. Untagged or implicit ':latest' without governance:
   - If the image repo has no explicit version tag (or only 'latest'), you cannot reliably prove that the cluster is on the intended latest CNI version.
     This requires policy review: pin to a known-good version recommended for your EKS/Kubernetes version.

5. Node binary mismatch:
   - If node-level /opt/cni/bin contents or versions differ from the aws-node image tag and documentation,
     the installed binaries may not match the expected CNI version and require manual investigation.

This check is MANUAL:
- Use the image tags, cluster version, and AWS/EKS documentation to decide whether you are on the latest *supported* CNI version for your environment.
- Plan a controlled upgrade if you determine that the running version is behind the recommended release.
EOF