Clarification on the VPC CNI ConfigMap

[BJKupka]

So, I have been working on upgrading an EKS cluster and recently saw a ConfigMap called amazon-vpc-cni was introduced to the manifest files. I'm trying to figure out the purpose of this ConfigMap as it doesn't actually seem to get used as far as I am aware. I could not find any diffs that show where the key/value pairs in the data map are being used and its definitely not referenced by any of the containers on the pod by default (plus the keys are named completely different than the convention expected by the containers).

The documentation on this ConfigMap starts and ends here in the README with little explanation as to what the various key/values are specifically for (plus the new key/value pairs are not documented at all). The helm chart has things that are named somewhat similarly, but again its not an exact match.

I am planning on omitting the ConfigMap from my cluster entirely because I just don't know what purpose it currently serves. The README documentation leads me to believe I could use reference it in lieu of other declared container-level env config, but the mapping is not 1:1.

Perhaps its part of a long-running refactor that may get used later? Anyone have any insight?

Ripped from the aws-k8s-cni.yaml from v1.16.0 of amazon-vpc-cni-k8s:

# Source: aws-vpc-cni/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: amazon-vpc-cni
  namespace: kube-system
  labels:
    app.kubernetes.io/name: aws-node
    app.kubernetes.io/instance: aws-vpc-cni
    k8s-app: aws-node
    app.kubernetes.io/version: "v1.16.0"
data:
  enable-windows-ipam: "false"
  enable-network-policy-controller: "false"
  enable-windows-prefix-delegation: "false"
  warm-prefix-target: "0"
  warm-ip-target: "1"
  minimum-ip-target: "3"
  branch-eni-cooldown: "60"

[jdn5126]

@BJKupka sorry for missing this, answer below:

The amazon-vpc-cni ConfigMap is used for configuration related to the AWS VPC CNI that is consumed by controllers.

Example controllers are https://github.com/aws/amazon-vpc-resource-controller-k8s and https://github.com/aws/amazon-network-policy-controller-k8s, which is why searching this repository for the keys does not yield any results.

You can omit the ConfigMap if you are not using any features that require these controllers, such as Security Groups for Pods or Network Policy.

[BJKupka]

Thanks for the reply. I ended up removing that ConfigMap from our cluster after all. Will revisit for our future cluster upgrades.

[jdn5126]

@BJKupka also, the warm/minimum target variables in the amazon-vpc-cni ConfigMap are only used for Windows Prefix Delegation, which the VPC Resource Controller manages. They do not override the aws-node Daemonset environment variables. The names were really poorly chosen, so we have a fix in progress that is tracked via #279.