Skip to content

Commit addd258

Browse files
vigh-mvigh-m
authored
Merge pull request #741 from vigh-m/1093-cherry-pick
Cherry-pick for 10.9.3 release
2 parents a3a7b9d + 9252ea6 commit addd258

23 files changed

+639
-8
lines changed

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,20 @@
1+
# v10.9.3 (2025-11-11)
2+
3+
## Orchestrator Changes
4+
### Kubernetes
5+
- Patch `ecr-credential-provider` to support AWS EUSC ([#729])
6+
7+
[#729]: https://github.com/bottlerocket-os/bottlerocket-core-kit/pull/729
8+
19
# v10.9.2 (2025-11-08)
10+
211
## OS Changes
312
- Patch runc to set the correct mode for tmpfs mounts ([#731])
413

514
[#731]: https://github.com/bottlerocket-os/bottlerocket-core-kit/pull/731
615

716
# v10.9.1 (2025-11-05)
17+
818
## OS Changes
919
- Update runc to v1.2.8 ([#708])
1020

‎Twoliter.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
schema-version = 2
2-
release-version = "10.9.2"
2+
release-version = "10.9.3"
33
project-vendor = "Bottlerocket"
44

55
[vendor.bottlerocket]

‎packages/ecr-credential-provider-1.28/0001-support-new-aws-partition-in-credential-provider.patch‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
From 9a0819d0782d06da30e4942f207c61f6a5cecf81 Mon Sep 17 00:00:00 2001
2+
From: Sam Berning <[email protected]>
3+
Date: Sat, 25 Oct 2025 01:19:05 +0000
4+
Subject: [PATCH] support new aws partition in credential provider
5+
6+
Signed-off-by: Sam Berning <[email protected]>
7+
---
8+
cmd/ecr-credential-provider/main.go | 2 +-
9+
cmd/ecr-credential-provider/main_test.go | 10 ++++++++++
10+
2 files changed, 11 insertions(+), 1 deletion(-)
11+
12+
diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
13+
index 0d78e046..b61bd789 100644
14+
--- a/cmd/ecr-credential-provider/main.go
15+
+++ b/cmd/ecr-credential-provider/main.go
16+
@@ -42,7 +42,7 @@ import (
17+
const ecrPublicRegion string = "us-east-1"
18+
const ecrPublicHost string = "public.ecr.aws"
19+
20+
-var ecrPrivateHostPattern = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.com(?:\.cn)?|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`)
21+
+var ecrPrivateHostPattern = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.(?:com(?:\.cn)?|eu)|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`)
22+
23+
// ECR abstracts the calls we make to aws-sdk for testing purposes
24+
type ECR interface {
25+
diff --git a/cmd/ecr-credential-provider/main_test.go b/cmd/ecr-credential-provider/main_test.go
26+
index 296506fb..d047e343 100644
27+
--- a/cmd/ecr-credential-provider/main_test.go
28+
+++ b/cmd/ecr-credential-provider/main_test.go
29+
@@ -352,6 +352,12 @@ func Test_parseRegionFromECRPrivateHost(t *testing.T) {
30+
host: "123456789123.dkr.ecr.us-iso-east-1.c2s.ic.gov",
31+
region: "us-iso-east-1",
32+
},
33+
+ // EUSC
34+
+ {
35+
+ name: "success",
36+
+ host: "123456789123.dkr.ecr.eusc-de-east-1.amazonaws.eu",
37+
+ region: "eusc-de-east-1",
38+
+ },
39+
// Dual-Stack
40+
{
41+
name: "success",
42+
@@ -411,6 +417,10 @@ func TestRegistryPatternMatch(t *testing.T) {
43+
{"123456789012.dkr.ecr-fips.lala-land-1.amazonaws.com", true},
44+
// .cn
45+
{"123456789012.dkr.ecr.lala-land-1.amazonaws.com.cn", true},
46+
+ // .eu
47+
+ {"123456789012.dkr.ecr.eusc-de-east-1.amazonaws.eu", true},
48+
+ // .eu with fips
49+
+ {"123456789012.dkr.ecr-fips.eusc-de-east-1.amazonaws.eu", true},
50+
// registry ID too long
51+
{"1234567890123.dkr.ecr.lala-land-1.amazonaws.com", false},
52+
// registry ID too short
53+
--
54+
2.42.0
55+

‎packages/ecr-credential-provider-1.28/0002-ecr-credential-provider-hardcode-ecr-endpoint-for-eu.patch‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From f718bd08a9d9c8a12471680b12da931a910b61a8 Mon Sep 17 00:00:00 2001
2+
From: Sam Berning <[email protected]>
3+
Date: Sat, 8 Nov 2025 00:20:30 +0000
4+
Subject: [PATCH] ecr-credential-provider: hardcode ecr endpoint for
5+
eusc-de-east-1
6+
7+
Signed-off-by: Sam Berning <[email protected]>
8+
---
9+
cmd/ecr-credential-provider/main.go | 6 +++++-
10+
1 file changed, 5 insertions(+), 1 deletion(-)
11+
12+
diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
13+
index 5b7d3f6d..ac01797f 100644
14+
--- a/cmd/ecr-credential-provider/main.go
15+
+++ b/cmd/ecr-credential-provider/main.go
16+
@@ -60,8 +60,12 @@ type ecrPlugin struct {
17+
}
18+
19+
func defaultECRProvider(region string) (*ecr.ECR, error) {
20+
+ cfg := aws.Config{Region: aws.String(region)};
21+
+ if region == "eusc-de-east-1" {
22+
+ cfg.Endpoint = aws.String("https://api.ecr.eusc-de-east-1.amazonaws.eu")
23+
+ }
24+
sess, err := session.NewSessionWithOptions(session.Options{
25+
- Config: aws.Config{Region: aws.String(region)},
26+
+ Config: cfg,
27+
SharedConfigState: session.SharedConfigEnable,
28+
})
29+
if err != nil {
30+
--
31+
2.42.0
32+

‎packages/ecr-credential-provider-1.28/ecr-credential-provider-1.28.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ Source: cloud-provider-aws-%{gover}.tar.gz
1919
Source1: bundled-cloud-provider-aws-%{gover}.tar.gz
2020
Source1000: clarify.toml
2121

22+
Patch0001: 0001-support-new-aws-partition-in-credential-provider.patch
23+
Patch0002: 0002-ecr-credential-provider-hardcode-ecr-endpoint-for-eu.patch
24+
2225
BuildRequires: %{_cross_os}glibc-devel
2326
Requires: %{name}(binaries)
2427

@@ -48,7 +51,7 @@ Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)
4851
%{summary}.
4952

5053
%prep
51-
%setup -n %{gorepo}-%{gover} -q
54+
%autosetup -Sgit -n %{gorepo}-%{gover} -p1
5255
%setup -T -D -n %{gorepo}-%{gover} -b 1 -q
5356

5457
%build

‎packages/ecr-credential-provider-1.29/0001-support-new-aws-partition-in-credential-provider.patch‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
From 9a0819d0782d06da30e4942f207c61f6a5cecf81 Mon Sep 17 00:00:00 2001
2+
From: Sam Berning <[email protected]>
3+
Date: Sat, 25 Oct 2025 01:19:05 +0000
4+
Subject: [PATCH] support new aws partition in credential provider
5+
6+
Signed-off-by: Sam Berning <[email protected]>
7+
---
8+
cmd/ecr-credential-provider/main.go | 2 +-
9+
cmd/ecr-credential-provider/main_test.go | 10 ++++++++++
10+
2 files changed, 11 insertions(+), 1 deletion(-)
11+
12+
diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
13+
index 0d78e046..b61bd789 100644
14+
--- a/cmd/ecr-credential-provider/main.go
15+
+++ b/cmd/ecr-credential-provider/main.go
16+
@@ -42,7 +42,7 @@ import (
17+
const ecrPublicRegion string = "us-east-1"
18+
const ecrPublicHost string = "public.ecr.aws"
19+
20+
-var ecrPrivateHostPattern = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.com(?:\.cn)?|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`)
21+
+var ecrPrivateHostPattern = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.(?:com(?:\.cn)?|eu)|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`)
22+
23+
// ECR abstracts the calls we make to aws-sdk for testing purposes
24+
type ECR interface {
25+
diff --git a/cmd/ecr-credential-provider/main_test.go b/cmd/ecr-credential-provider/main_test.go
26+
index 296506fb..d047e343 100644
27+
--- a/cmd/ecr-credential-provider/main_test.go
28+
+++ b/cmd/ecr-credential-provider/main_test.go
29+
@@ -352,6 +352,12 @@ func Test_parseRegionFromECRPrivateHost(t *testing.T) {
30+
host: "123456789123.dkr.ecr.us-iso-east-1.c2s.ic.gov",
31+
region: "us-iso-east-1",
32+
},
33+
+ // EUSC
34+
+ {
35+
+ name: "success",
36+
+ host: "123456789123.dkr.ecr.eusc-de-east-1.amazonaws.eu",
37+
+ region: "eusc-de-east-1",
38+
+ },
39+
// Dual-Stack
40+
{
41+
name: "success",
42+
@@ -411,6 +417,10 @@ func TestRegistryPatternMatch(t *testing.T) {
43+
{"123456789012.dkr.ecr-fips.lala-land-1.amazonaws.com", true},
44+
// .cn
45+
{"123456789012.dkr.ecr.lala-land-1.amazonaws.com.cn", true},
46+
+ // .eu
47+
+ {"123456789012.dkr.ecr.eusc-de-east-1.amazonaws.eu", true},
48+
+ // .eu with fips
49+
+ {"123456789012.dkr.ecr-fips.eusc-de-east-1.amazonaws.eu", true},
50+
// registry ID too long
51+
{"1234567890123.dkr.ecr.lala-land-1.amazonaws.com", false},
52+
// registry ID too short
53+
--
54+
2.42.0
55+

‎packages/ecr-credential-provider-1.29/0002-ecr-credential-provider-hardcode-ecr-endpoint-for-eu.patch‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From f982a493072fd8ca9af7d14e5d33e393f3e9fdfb Mon Sep 17 00:00:00 2001
2+
From: Sam Berning <[email protected]>
3+
Date: Wed, 29 Oct 2025 20:19:45 +0000
4+
Subject: [PATCH] ecr-credential-provider: hardcode ecr endpoint for
5+
eusc-de-east-1
6+
7+
Signed-off-by: Sam Berning <[email protected]>
8+
---
9+
cmd/ecr-credential-provider/main.go | 3 +++
10+
1 file changed, 3 insertions(+)
11+
12+
diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
13+
index d0033010..a90ffcb5 100644
14+
--- a/cmd/ecr-credential-provider/main.go
15+
+++ b/cmd/ecr-credential-provider/main.go
16+
@@ -64,6 +64,9 @@ func defaultECRProvider(region string) (*ecr.ECR, error) {
17+
if region != "" {
18+
klog.Warningf("No region found in the image reference, the default region will be used. Please refer to AWS SDK documentation for configuration purpose.")
19+
cfg.Region = aws.String(region)
20+
+ if region == "eusc-de-east-1" {
21+
+ cfg.Endpoint = aws.String("https://api.ecr.eusc-de-east-1.amazonaws.eu")
22+
+ }
23+
}
24+
sess, err := session.NewSessionWithOptions(session.Options{
25+
Config: cfg,
26+
--
27+
2.42.0
28+

‎packages/ecr-credential-provider-1.29/ecr-credential-provider-1.29.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ Source: cloud-provider-aws-%{gover}.tar.gz
1919
Source1: bundled-cloud-provider-aws-%{gover}.tar.gz
2020
Source1000: clarify.toml
2121

22+
Patch0001: 0001-support-new-aws-partition-in-credential-provider.patch
23+
Patch0002: 0002-ecr-credential-provider-hardcode-ecr-endpoint-for-eu.patch
24+
2225
BuildRequires: %{_cross_os}glibc-devel
2326
Requires: %{name}(binaries)
2427

@@ -48,7 +51,7 @@ Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)
4851
%{summary}.
4952

5053
%prep
51-
%setup -n %{gorepo}-%{gover} -q
54+
%autosetup -Sgit -n %{gorepo}-%{gover} -p1
5255
%setup -T -D -n %{gorepo}-%{gover} -b 1 -q
5356

5457
%build

‎packages/ecr-credential-provider-1.30/0001-support-new-aws-partition-in-credential-provider.patch‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
From 9a0819d0782d06da30e4942f207c61f6a5cecf81 Mon Sep 17 00:00:00 2001
2+
From: Sam Berning <[email protected]>
3+
Date: Sat, 25 Oct 2025 01:19:05 +0000
4+
Subject: [PATCH] support new aws partition in credential provider
5+
6+
Signed-off-by: Sam Berning <[email protected]>
7+
---
8+
cmd/ecr-credential-provider/main.go | 2 +-
9+
cmd/ecr-credential-provider/main_test.go | 10 ++++++++++
10+
2 files changed, 11 insertions(+), 1 deletion(-)
11+
12+
diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
13+
index 0d78e046..b61bd789 100644
14+
--- a/cmd/ecr-credential-provider/main.go
15+
+++ b/cmd/ecr-credential-provider/main.go
16+
@@ -42,7 +42,7 @@ import (
17+
const ecrPublicRegion string = "us-east-1"
18+
const ecrPublicHost string = "public.ecr.aws"
19+
20+
-var ecrPrivateHostPattern = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.com(?:\.cn)?|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`)
21+
+var ecrPrivateHostPattern = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(\-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.(?:com(?:\.cn)?|eu)|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov)$`)
22+
23+
// ECR abstracts the calls we make to aws-sdk for testing purposes
24+
type ECR interface {
25+
diff --git a/cmd/ecr-credential-provider/main_test.go b/cmd/ecr-credential-provider/main_test.go
26+
index 296506fb..d047e343 100644
27+
--- a/cmd/ecr-credential-provider/main_test.go
28+
+++ b/cmd/ecr-credential-provider/main_test.go
29+
@@ -352,6 +352,12 @@ func Test_parseRegionFromECRPrivateHost(t *testing.T) {
30+
host: "123456789123.dkr.ecr.us-iso-east-1.c2s.ic.gov",
31+
region: "us-iso-east-1",
32+
},
33+
+ // EUSC
34+
+ {
35+
+ name: "success",
36+
+ host: "123456789123.dkr.ecr.eusc-de-east-1.amazonaws.eu",
37+
+ region: "eusc-de-east-1",
38+
+ },
39+
// Dual-Stack
40+
{
41+
name: "success",
42+
@@ -411,6 +417,10 @@ func TestRegistryPatternMatch(t *testing.T) {
43+
{"123456789012.dkr.ecr-fips.lala-land-1.amazonaws.com", true},
44+
// .cn
45+
{"123456789012.dkr.ecr.lala-land-1.amazonaws.com.cn", true},
46+
+ // .eu
47+
+ {"123456789012.dkr.ecr.eusc-de-east-1.amazonaws.eu", true},
48+
+ // .eu with fips
49+
+ {"123456789012.dkr.ecr-fips.eusc-de-east-1.amazonaws.eu", true},
50+
// registry ID too long
51+
{"1234567890123.dkr.ecr.lala-land-1.amazonaws.com", false},
52+
// registry ID too short
53+
--
54+
2.42.0
55+

‎packages/ecr-credential-provider-1.30/0002-ecr-credential-provider-hardcode-ECR-endpoint-for-eu.patch‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
From 99df7b5980be2e66d2bbb32b405d24e0d64dbe85 Mon Sep 17 00:00:00 2001
2+
From: Sam Berning <[email protected]>
3+
Date: Fri, 7 Nov 2025 02:21:18 +0000
4+
Subject: [PATCH] ecr-credential-provider: hardcode ECR endpoint for
5+
eusc-de-east-1
6+
7+
Signed-off-by: Sam Berning <[email protected]>
8+
---
9+
cmd/ecr-credential-provider/main.go | 6 +++++-
10+
1 file changed, 5 insertions(+), 1 deletion(-)
11+
12+
diff --git a/cmd/ecr-credential-provider/main.go b/cmd/ecr-credential-provider/main.go
13+
index b61bd789..15642223 100644
14+
--- a/cmd/ecr-credential-provider/main.go
15+
+++ b/cmd/ecr-credential-provider/main.go
16+
@@ -75,7 +75,11 @@ func defaultECRProvider(ctx context.Context, region string) (ECR, error) {
17+
return nil, err
18+
}
19+
20+
- return ecr.NewFromConfig(cfg), nil
21+
+ return ecr.NewFromConfig(cfg, func(o *ecr.Options) {
22+
+ if region == "eusc-de-east-1" {
23+
+ o.BaseEndpoint = aws.String("https://api.ecr.eusc-de-east-1.amazonaws.eu")
24+
+ }
25+
+ }), nil
26+
}
27+
28+
func publicECRProvider(ctx context.Context) (ECRPublic, error) {
29+
--
30+
2.42.0
31+

0 commit comments

Comments
 (0)