Does aws-vpc-cni-k8s tag the warm target ENIs

[steffakasid]

What happened:

In our AWS accounts we use compliance scans e.g. to ensure all resources are having certain tags. With this scans we find a small amount of ENIs within our clusters which are not bound to any instance without any tags. I think that those ENIs are the "warm target ENIs" create by aws-vpc-cni-k8s. Is it possible that the warm target ENIs are not tagged even if we run the controller with ADDITIONAL_ENI_TAGS set?

Environment:

• Kubernetes version (use kubectl version):

Client Version: v1.32.2
Kustomize Version: v5.5.0
Server Version: v1.29.13-eks-8cce635

• CNI Version: v1.19.2
• OS (e.g: cat /etc/os-release):

NAME="Amazon Linux"
VERSION="2023"
ID="amzn"
ID_LIKE="fedora"
VERSION_ID="2023"
PLATFORM_ID="platform:al2023"
PRETTY_NAME="Amazon Linux 2023.6.20250203"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2023"
HOME_URL="https://aws.amazon.com/linux/amazon-linux-2023/"
DOCUMENTATION_URL="https://docs.aws.amazon.com/linux/"
SUPPORT_URL="https://aws.amazon.com/premiumsupport/"
BUG_REPORT_URL="https://github.com/amazonlinux/amazon-linux-2023"
VENDOR_NAME="AWS"
VENDOR_URL="https://aws.amazon.com/"
SUPPORT_END="2029-06-30"

• Kernel (e.g. uname -a): Linux ip-10-104-156-165.eu-central-1.compute.internal 6.1.127-135.201.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jan 28 23:19:58 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

[steffakasid]

I found it the ENIs were not created by aws-vpc-cni. They are from the EKS cluster itself: https://repost.aws/questions/QUIkhPjRVBTqWzm4AutiPqHg/how-eks-control-plane-is-communicate-with-worker-node

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.