Missing CRDs after upgrade

[jdn5126]

Describe the Bug:
Following VPC Resource Controller upgrade from v1.1.4 to v1.1.5, SecurityGroupPolicy objects created before the upgrade are returning as not found by the annotation webhook:

Webhook couldn't find SGP definition: GroupVersionResource or GroupKind didn't match. Will allow regular pods creation.

Those objects are present when kubectl get SecurityGroupPolicy -A is run.

Observed Behavior:
Newly created pods are not annotated with the correct branch ENI.

Expected Behavior:
Pods should be annotated based on the SecurityGroupPolicy that they match.

How to reproduce it (as minimally and precisely as possible):
It is not clear how to reproduce this, though the setup seems to require:

1. VPC RC v1.1.4 and SecurityGroupPolicy objects to exist
2. VPC RC upgrade

Additional Context:

Environment: EKS 1.24

• Kubernetes version (use kubectl version): v1.24
• CNI Version - v1.12.6
• OS (Linux/Windows): Linux

[hitsub2]

If we upgrade EKS control plane from 1.24 to 1.25, the vpc resource controller will also be upgraded from v1.1.4 to v1.1.5 automatically? Or does AWS sometime upgrade the vpc resource to newer version as needed?

[haouc]

@hitsub2 sorry for a late response. When you update your control plane, the service in control plane will be updated to the latest version. If you don't update, EKS will keep services updated as needed.

[haouc]

This should be a cache missing issue. We are using cached client. We are working on upgrading dependencies to make it more resilient.

[haouc]

Since it is not reproducible, I am closing it for now. Please feel free to reopen for any concern.