DataDog
diff --git a/‎.github/workflows/kpromo-reminder.yaml‎
Lines changed: 33 additions & 0 deletions b/‎.github/workflows/kpromo-reminder.yaml‎
Lines changed: 33 additions & 0 deletions
diff --git a/‎.ko.yaml‎
Lines changed: 1 addition & 1 deletion b/‎.ko.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎Dockerfile‎
Lines changed: 1 addition & 1 deletion b/‎Dockerfile‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎OWNERS‎
Lines changed: 2 additions & 0 deletions b/‎OWNERS‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎THIRD-PARTY-LICENSES‎
Lines changed: 3 additions & 3 deletions b/‎THIRD-PARTY-LICENSES‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎charts/aws-cloud-controller-manager/Chart.yaml‎
Lines changed: 2 additions & 2 deletions b/‎charts/aws-cloud-controller-manager/Chart.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎charts/aws-cloud-controller-manager/values.yaml‎
Lines changed: 1 addition & 1 deletion b/‎charts/aws-cloud-controller-manager/values.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎cloudbuild.yaml‎
Lines changed: 1 addition & 1 deletion b/‎cloudbuild.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎cmd/ecr-credential-provider/main.go‎
Lines changed: 98 additions & 8 deletions b/‎cmd/ecr-credential-provider/main.go‎
Lines changed: 98 additions & 8 deletions
@@ -0,0 +1,33 @@
+name: kpromo reminder
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - master
+      - 'release-**'
+    paths:
+      - 'version.txt'
+
+jobs:
+  comment-on-version-change:
+    # Only run if the PR was merged (not just closed)
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment on PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const prAuthor = context.payload.pull_request.user.login;
+
+            const commentBody = `🤖 Hey @${prAuthor}, it looks like you may have released a new version! Don't forget to run the image promotion workflow within 60 days if needed.`;
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
@@ -1 +1 @@
-defaultBaseImage: registry.k8s.io/build-image/go-runner:v2.4.0-go1.24.0-bookworm.0
+defaultBaseImage: registry.k8s.io/build-image/go-runner:v2.4.0-go1.24.4-bookworm.0
@@ -14,7 +14,7 @@
 ##                               BUILD ARGS                                   ##
 ################################################################################
 # This build arg allows the specification of a custom Golang image.
-ARG GOLANG_IMAGE=golang:1.24.0
+ARG GOLANG_IMAGE=golang:1.24.4
 
 # Datadog's base docker image
 ARG BASE_IMAGE
 
@@ -8,6 +8,7 @@ approvers:
 - mmerkes
 - wongma7
 - kmala
+- yue9944882
 reviewers:
 - dims
 - nckturner
@@ -17,6 +18,7 @@ reviewers:
 - cartermckinnon
 - mmerkes
 - kmala
+- yue9944882
 emeritus_approvers:
 - zmerlynn
 - gnufied
 
@@ -180,7 +180,7 @@ Copyright © 2015 Steve Francia <spf@spf13.com>
 
 -----
 
-** aws/aws-sdk-go; version 1.15.7 -- https://github.com/aws/aws-sdk-go/
+** aws/aws-sdk-go-v2; version 1.24.4 -- https://github.com/aws/aws-sdk-go-v2/
 ** Etcd; version v3.1.0-alpha.1 -- https://github.com/coreos/etcd/tree/v3.1.0-alpha.1
 ** github.com/coreos/go-semver; version 0.2 -- https://github.com/coreos/go-semver
 ** github.com/coreos/go-systemd/; version 10 -- https://github.com/coreos/go-systemd/
@@ -412,9 +412,9 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
-* For aws/aws-sdk-go see also this required NOTICE:
+* For aws/aws-sdk-go-v2 see also this required NOTICE:
 AWS SDK for Go
-Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved. 
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 Copyright 2014-2015 Stripe, Inc.
 * For Etcd see also this required NOTICE:
 CoreOS Project
 
@@ -2,8 +2,8 @@
 apiVersion: v1
 name: aws-cloud-controller-manager
 description: Installs Cloud Controller Manager for AWS Cloud Provider
-version: 0.0.8
-appVersion: v1.27.1
+version: 0.0.9
+appVersion: v1.33.0
 maintainers:
 - name: Nick Turner
   email: nic@amazon.com
 
@@ -6,7 +6,7 @@ args:
 
 image:
     repository: registry.k8s.io/provider-aws/cloud-controller-manager
-    tag: v1.27.1
+    tag: v1.33.0
 
 # Specify image pull secrets
 imagePullSecrets: []
 
@@ -17,7 +17,7 @@ steps:
       - --platform=linux/amd64,linux/arm64
       - .
   # Build cloudbuild artifacts (for attestation)
-  - name: 'docker.io/library/golang:1.24.0-bookworm'
+  - name: 'docker.io/library/golang:1.24.4-bookworm'
     id: cloudbuild-artifacts
     entrypoint: make
     env:
 
@@ -31,6 +31,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/ecr"
 	"github.com/aws/aws-sdk-go-v2/service/ecrpublic"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/spf13/cobra"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -54,9 +55,15 @@ type ECRPublic interface {
 	GetAuthorizationToken(ctx context.Context, params *ecrpublic.GetAuthorizationTokenInput, optFns ...func(*ecrpublic.Options)) (*ecrpublic.GetAuthorizationTokenOutput, error)
 }
 
+// STS abstracts the calls we make to aws-sdk for testing purposes
+type STS interface {
+	AssumeRoleWithWebIdentity(context.Context, *sts.AssumeRoleWithWebIdentityInput, ...func(*sts.Options)) (*sts.AssumeRoleWithWebIdentityOutput, error)
+}
+
 type ecrPlugin struct {
 	ecr       ECR
 	ecrPublic ECRPublic
+	sts       STS
 }
 
 func defaultECRProvider(ctx context.Context, region string) (ECR, error) {
@@ -91,12 +98,30 @@ func publicECRProvider(ctx context.Context) (ECRPublic, error) {
 	return ecrpublic.NewFromConfig(cfg), nil
 }
 
+func stsProvider(ctx context.Context, region string) (STS, error) {
+	var cfg aws.Config
+	var err error
+	if region != "" {
+		cfg, err = config.LoadDefaultConfig(ctx,
+			config.WithRegion(region),
+		)
+	} else {
+		klog.Warningf("No region found in the image reference, the default region will be used. Please refer to AWS SDK documentation for configuration purpose.")
+		cfg, err = config.LoadDefaultConfig(ctx)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+	return sts.NewFromConfig(cfg), nil
+}
+
 type credsData struct {
 	authToken *string
 	expiresAt *time.Time
 }
 
-func (e *ecrPlugin) getPublicCredsData(ctx context.Context) (*credsData, error) {
+func (e *ecrPlugin) getPublicCredsData(ctx context.Context, optFns ...func(*ecrpublic.Options)) (*credsData, error) {
 	klog.Infof("Getting creds for public registry")
 	var err error
 
@@ -107,7 +132,7 @@ func (e *ecrPlugin) getPublicCredsData(ctx context.Context) (*credsData, error)
 		return nil, err
 	}
 
-	output, err := e.ecrPublic.GetAuthorizationToken(ctx, &ecrpublic.GetAuthorizationTokenInput{})
+	output, err := e.ecrPublic.GetAuthorizationToken(ctx, &ecrpublic.GetAuthorizationTokenInput{}, optFns...)
 	if err != nil {
 		return nil, err
 	}
@@ -126,7 +151,7 @@ func (e *ecrPlugin) getPublicCredsData(ctx context.Context) (*credsData, error)
 	}, nil
 }
 
-func (e *ecrPlugin) getPrivateCredsData(ctx context.Context, imageHost string, image string) (*credsData, error) {
+func (e *ecrPlugin) getPrivateCredsData(ctx context.Context, imageHost string, image string, optFns ...func(*ecr.Options)) (*credsData, error) {
 	klog.Infof("Getting creds for private image %s", image)
 	var err error
 
@@ -137,7 +162,8 @@ func (e *ecrPlugin) getPrivateCredsData(ctx context.Context, imageHost string, i
 			return nil, err
 		}
 	}
-	output, err := e.ecr.GetAuthorizationToken(ctx, &ecr.GetAuthorizationTokenInput{})
+
+	output, err := e.ecr.GetAuthorizationToken(ctx, &ecr.GetAuthorizationTokenInput{}, optFns...)
 	if err != nil {
 		return nil, err
 	}
@@ -153,19 +179,83 @@ func (e *ecrPlugin) getPrivateCredsData(ctx context.Context, imageHost string, i
 	}, nil
 }
 
-func (e *ecrPlugin) GetCredentials(ctx context.Context, image string, args []string) (*v1.CredentialProviderResponse, error) {
+func (e *ecrPlugin) buildCredentialsProvider(ctx context.Context, request *v1.CredentialProviderRequest, imageHost string) (aws.CredentialsProvider, error) {
+	var err error
+
+	arn, ok := request.ServiceAccountAnnotations["eks.amazonaws.com/ecr-role-arn"]
+	if !ok {
+		arn = os.Getenv("AWS_ECR_ROLE_ARN")
+	}
+	if arn == "" {
+		return nil, errors.New("no arn provided, cannot assume role using ServiceAccountToken")
+	}
+
+	if e.sts == nil {
+		region := ""
+		if imageHost != ecrPublicHost {
+			region = parseRegionFromECRPrivateHost(imageHost)
+		}
+		e.sts, err = stsProvider(ctx, region)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return aws.CredentialsProviderFunc(func(ctx context.Context) (aws.Credentials, error) {
+			assumeOutput, err := e.sts.AssumeRoleWithWebIdentity(ctx, &sts.AssumeRoleWithWebIdentityInput{
+				RoleArn:          aws.String(arn),
+				RoleSessionName:  aws.String("ecr-credential-provider"),
+				WebIdentityToken: aws.String(request.ServiceAccountToken),
+			})
+			if err != nil {
+				return aws.Credentials{}, fmt.Errorf("failed to assume role: %w", err)
+			}
+			return aws.Credentials{
+				AccessKeyID:     *assumeOutput.Credentials.AccessKeyId,
+				SecretAccessKey: *assumeOutput.Credentials.SecretAccessKey,
+				SessionToken:    *assumeOutput.Credentials.SessionToken,
+			}, nil
+		}),
+		nil
+}
+
+func (e *ecrPlugin) GetCredentials(ctx context.Context, request *v1.CredentialProviderRequest, args []string) (*v1.CredentialProviderResponse, error) {
 	var creds *credsData
 	var err error
 
-	imageHost, err := parseHostFromImageReference(image)
+	if request.Image == "" {
+		return nil, errors.New("image in plugin request was empty")
+	}
+
+	imageHost, err := parseHostFromImageReference(request.Image)
 	if err != nil {
 		return nil, err
 	}
 
+	var credentialsProvider aws.CredentialsProvider = nil
+	if request.ServiceAccountToken != "" {
+		credentialsProvider, err = e.buildCredentialsProvider(ctx, request, imageHost)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	if imageHost == ecrPublicHost {
-		creds, err = e.getPublicCredsData(ctx)
+		var optFns = []func(*ecrpublic.Options){}
+		if credentialsProvider != nil {
+			optFns = append(optFns, func(o *ecrpublic.Options) {
+				o.Credentials = credentialsProvider
+			})
+		}
+		creds, err = e.getPublicCredsData(ctx, optFns...)
 	} else {
-		creds, err = e.getPrivateCredsData(ctx, imageHost, image)
+		var optFns = []func(*ecr.Options){}
+		if credentialsProvider != nil {
+			optFns = append(optFns, func(o *ecr.Options) {
+				o.Credentials = credentialsProvider
+			})
+		}
+		creds, err = e.getPrivateCredsData(ctx, imageHost, request.Image, optFns...)
 	}
 
 	if err != nil {
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-defaultBaseImage: registry.k8s.io/build-image/go-runner:v2.4.0-go1.24.0-bookworm.0`
	`1`	`+defaultBaseImage: registry.k8s.io/build-image/go-runner:v2.4.0-go1.24.4-bookworm.0`