STOR-2918: Rebase to upstream v1.62.0 for OCP 5.0

[dfajmon]

STOR-2918: Rebase to upstream v1.62.0 for OCP 5.0

Issue link
https://redhat.atlassian.net/browse/STOR-2918

Diff to upstream v1.62.0
kubernetes-sigs/aws-ebs-csi-driver@v1.62.0...dfajmon:rebase-v1.62.0

Notes for reviewers

Upgrade notice (v1.49.0): The EBS CSI Driver Controller's readiness and liveness probes now periodically check AWS API access via a dry-run DescribeAvailabilityZones call. Clusters with broken networking/DNS or incorrectly configured IAM may fail to install.

Upgrade notice (v1.59.0): The driver now calls DescribeInstanceTypes at runtime for multi-card EBS instance handling. Custom IAM policies must add DescribeInstanceTypes. A fallback table is still present but will be removed in a future release.

Volume cloning has strict restrictions declared in https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copying-volume.html#copy-volume-consids. This can make parallel tests fail for cloning too many volumes at the same time.

Summary of changes

Breaking Changes

• Remove -a1compat image for a1.* family Amazon EC2 instances; upgrade to a more recent AWS Graviton instance type (#2836)

Major Features

• Add ability to provision volumes using AZ-ID (#2613)
• Add dry-run EC2 API call to ebs-csi-driver controller readiness/liveness probes (#2590)
• Retrieve maximum IOPS limit dynamically via CreateVolume dry-run to support increased IOPS limits for GP3 and other volume types (#2682)
• Add support for creating instant, point-in-time copies of EBS volumes within the same Availability Zone (#2716)
• Add ALPHA metadata-labeler sidecar and metadata source (#2591)
• Add node-local volume support, enabling a single cluster-wide PV/PVC to mount node-specific EBS volumes with ReadWriteMany access (#2726)
• Add support for custom build-time plugins to extend or modify EBS CSI Driver behavior (#2786)
• Automatically assign EBS card index for instances with multiple EBS cards (#2835)
• Detect, abort, and retry stuck attachments (#2833)
• Adding SnapshotLock Capabilities (#2797)
• Add encryption support ext4 format option to StorageClass params (#2820)
• Add support for Windows Server 2025 (#2831)
• When --k8s-tag-cluster-id is set, tag volumes and snapshots with ebs.csi.aws.com/cluster-name to support cluster-scoped IAM policies (#2899)
• Call DescribeInstanceTypes at runtime for EBS multi-card instances (#2916)
• Add plugin method to override health check (#2952)

Notable Bug Fixes

• Fix cluster tags incorrectly overriding user-specified tags from StorageClass parameters (#2655)
• Update several incorrect EBS volume limits via generating table from DescribeInstanceTypes API (#2660)
• Fix throughput handling when creating volumes (#2733)
• Fix off-by-one error in volume limits for default nitro instances which would get PVCs stuck attempting to attach to a full instance (#2749)
• Improve error handling of taint removal; Fix last chance taint removal not functioning (#2699)
• Fix error handling when re-fetching the node object during agent-not-ready taint removal attempts (#2847)
• Handle duplicate CreateVolume RPCs for in-use volumes (#2908)
• Prevent deletion of reserved tag keys during volume modification (#2919)
• Fix init order bug that allowed modifying tags reserved for use by the EBS CSI Driver (#2932)
• Fix possible nil pointer deref on clones path (#2931)
• Add mutex to MetricRecorder to prevent crashes caused by concurrent access (#2933)
• Fixing warn-on-invalid-tag validation bug (#2954)

CVE Fixes

CVE-2026-33814, CVE-2026-33186, CVE-2025-61726

Cherry-picked commits

Commit	Subject	Author
fdc2f42a2	UPSTREAM: <carry>: Add OpenShift files	Daniel Fajmon
7e6a7798f	UPSTREAM: <carry>: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 5.0	AOS Automation Release Team
0a05883f1	UPSTREAM: <carry>: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 5.0	Radomir Vagner

Upstream changelogs

The project uses a shared CHANGELOG.md covering all releases (no per-release changelog pages):

• CHANGELOG.md

Full changelog

kubernetes-sigs/aws-ebs-csi-driver@v1.48.0...v1.62.0

Last rebase

#294

@openshift/storage

---

Co-authored by Claude

Summary by CodeRabbit

• New Features

  • Added support for node-local volumes, metadata labeling, volume cloning, snapshot locking, and volume property verification.
  • Expanded Windows and E2E test coverage, including new parameterized test runs and multi-card validation.

• Bug Fixes

  • Improved volume attach limits, resizing behavior, health checks, and node/pod handling.
  • Updated RBAC and workload defaults for better compatibility across Kubernetes versions.

• Documentation

  • Added and refreshed docs for installation, parameters, snapshots, Outposts, plugins, node-local volumes, and IAM policies.

• Chores

  • Updated Helm chart/app versions, images, tooling, and release notes.

[jsafrane]

/test e2e-aws-csi-extended

[gnufied]

/retest

[gnufied]

/test

[dfajmon]

/test e2e-aws-csi-extended

[openshift-ci]

@dfajmon: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-csi-extended	6efa66d	link	false	/test e2e-aws-csi-extended

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jsafrane]

/payload-job-with-prs periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance openshift/hypershift#8954

[openshift-ci]

@jsafrane: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[jsafrane]

/payload-job-with-prs periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance openshift/hypershift#8954

[openshift-ci]

@jsafrane: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/3ebb46e0-8f5c-11f1-94da-62fc0fbf34db-0

[gnufied]

/payload-job-with-prs pull-ci-openshift-hypershift-release-5.0-e2e-aws-ovn-conformance-ccm openshift/hypershift#8954

[openshift-ci]

@gnufied: trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

[gnufied]

The failure is because of the way hypershift binary is built and used in in the CI.

The selected periodic configuration defines hypershift-operator as a prebuilt base image in the periodics config. Consequently:

• Old base image used by create-hostedcluster: digest 0053cae8…

• PR-built HyperShift image: digest 5178fb5d…, published as stable:hypershift-operator

The create step therefore ran the old /usr/bin/hypershift from the periodic base image. The command itself is visible in the step definition.

I think we should merge hypershift change first and then merge this one. We have some work to do to fix the CI. It is kinda ugly.

[dfajmon]

/payload-job periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-1of2 periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-2of2 periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-1of3 periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-2of3 periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-3of3 periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn

[openshift-ci]

@dfajmon: trigger 11 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node
• periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-upgrade-fips
• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance
• periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-1of2
• periodic-ci-openshift-release-main-nightly-5.0-e2e-aws-ovn-serial-2of2
• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview
• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-1of3
• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-2of3
• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-ovn-techpreview-serial-3of3
• periodic-ci-openshift-release-main-ci-5.0-upgrade-from-stable-4.22-e2e-aws-ovn-upgrade
• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/6ba689d0-8ff2-11f1-95b4-2fdc8bb54c81-0

[dfajmon]

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance

[openshift-ci]

@dfajmon: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/584e3970-8fff-11f1-80d3-23ed726212b3-0

[jsafrane]

Re-running failed payload jobs

• all hypershfit ones: they failed because STOR-2918: update AWS EBS CSI credentials request policy to mirror upstream hypershift#8954 was not merged at the time they ran
• SNO: "[Monitor:legacy-kube-apiserver-invariants][sig-node] static pods should start after being created

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance,periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn,periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

[jsafrane]

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance,periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn,periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

[openshift-ci]

@jsafrane: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[jsafrane]

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

[openshift-ci]

@jsafrane: trigger 3 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn-conformance
• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn
• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/05492930-9020-11f1-979b-9d0416aa4779-0

[mpatlasov]

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn

[openshift-ci]

@mpatlasov: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/157349a0-904b-11f1-9d4c-9ec0699fe6ac-0

[dfajmon]

/payload-job periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn

[openshift-ci]

@dfajmon: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-hypershift-release-5.0-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/67f3a070-90a1-11f1-958b-240bb8230c5e-0

[dfajmon]

/verified by @dfajmon
Run manual CSI tests on deployed cluster. All tests passed except 2: "parallel cloning from pvc as data source", showing that AWS has copying limitations which is expected.
https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copying-volume.html#copy-volume-consids

[openshift-ci-robot]

@dfajmon: This PR has been marked as verified by @dfajmon.

Details

In response to this:

/verified by @dfajmon
Run manual CSI tests on deployed cluster. All tests passed except 2: "parallel cloning from pvc as data source", showing that AWS has copying limitations which is expected.
https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copying-volume.html#copy-volume-consids

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@dfajmon: This pull request references STOR-2918 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "5.0.0" version, but multiple target versions were set.

Details

In response to this:

STOR-2918: Rebase to upstream v1.62.0 for OCP 5.0

Issue link
https://redhat.atlassian.net/browse/STOR-2918

Diff to upstream v1.62.0
kubernetes-sigs/aws-ebs-csi-driver@v1.62.0...dfajmon:rebase-v1.62.0

Notes for reviewers

Upgrade notice (v1.49.0): The EBS CSI Driver Controller's readiness and liveness probes now periodically check AWS API access via a dry-run DescribeAvailabilityZones call. Clusters with broken networking/DNS or incorrectly configured IAM may fail to install.

Upgrade notice (v1.59.0): The driver now calls DescribeInstanceTypes at runtime for multi-card EBS instance handling. Custom IAM policies must add DescribeInstanceTypes. A fallback table is still present but will be removed in a future release.

Volume cloning has strict restrictions declared in https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copying-volume.html#copy-volume-consids. This can make parallel tests fail for cloning too many volumes at the same time.

Summary of changes

Breaking Changes

• Remove -a1compat image for a1.* family Amazon EC2 instances; upgrade to a more recent AWS Graviton instance type (#2836)

Major Features

• Add ability to provision volumes using AZ-ID (#2613)
• Add dry-run EC2 API call to ebs-csi-driver controller readiness/liveness probes (#2590)
• Retrieve maximum IOPS limit dynamically via CreateVolume dry-run to support increased IOPS limits for GP3 and other volume types (#2682)
• Add support for creating instant, point-in-time copies of EBS volumes within the same Availability Zone (#2716)
• Add ALPHA metadata-labeler sidecar and metadata source (#2591)
• Add node-local volume support, enabling a single cluster-wide PV/PVC to mount node-specific EBS volumes with ReadWriteMany access (#2726)
• Add support for custom build-time plugins to extend or modify EBS CSI Driver behavior (#2786)
• Automatically assign EBS card index for instances with multiple EBS cards (#2835)
• Detect, abort, and retry stuck attachments (#2833)
• Adding SnapshotLock Capabilities (#2797)
• Add encryption support ext4 format option to StorageClass params (#2820)
• Add support for Windows Server 2025 (#2831)
• When --k8s-tag-cluster-id is set, tag volumes and snapshots with ebs.csi.aws.com/cluster-name to support cluster-scoped IAM policies (#2899)
• Call DescribeInstanceTypes at runtime for EBS multi-card instances (#2916)
• Add plugin method to override health check (#2952)

Notable Bug Fixes

• Fix cluster tags incorrectly overriding user-specified tags from StorageClass parameters (#2655)
• Update several incorrect EBS volume limits via generating table from DescribeInstanceTypes API (#2660)
• Fix throughput handling when creating volumes (#2733)
• Fix off-by-one error in volume limits for default nitro instances which would get PVCs stuck attempting to attach to a full instance (#2749)
• Improve error handling of taint removal; Fix last chance taint removal not functioning (#2699)
• Fix error handling when re-fetching the node object during agent-not-ready taint removal attempts (#2847)
• Handle duplicate CreateVolume RPCs for in-use volumes (#2908)
• Prevent deletion of reserved tag keys during volume modification (#2919)
• Fix init order bug that allowed modifying tags reserved for use by the EBS CSI Driver (#2932)
• Fix possible nil pointer deref on clones path (#2931)
• Add mutex to MetricRecorder to prevent crashes caused by concurrent access (#2933)
• Fixing warn-on-invalid-tag validation bug (#2954)

CVE Fixes

CVE-2026-33814, CVE-2026-33186, CVE-2025-61726

Cherry-picked commits

Commit	Subject	Author
fdc2f42a2	UPSTREAM: <carry>: Add OpenShift files	Daniel Fajmon
7e6a7798f	UPSTREAM: <carry>: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 5.0	AOS Automation Release Team
0a05883f1	UPSTREAM: <carry>: Updating ose-aws-ebs-csi-driver-container image to be consistent with ART for 5.0	Radomir Vagner

Upstream changelogs

The project uses a shared CHANGELOG.md covering all releases (no per-release changelog pages):

• CHANGELOG.md

Full changelog

kubernetes-sigs/aws-ebs-csi-driver@v1.48.0...v1.62.0

Last rebase

#294

@openshift/storage

---

Co-authored by Claude

Summary by CodeRabbit

• New Features

• Added support for node-local volumes, metadata labeling, volume cloning, snapshot locking, and volume property verification.

• Expanded Windows and E2E test coverage, including new parameterized test runs and multi-card validation.

• Bug Fixes

• Improved volume attach limits, resizing behavior, health checks, and node/pod handling.

• Updated RBAC and workload defaults for better compatibility across Kubernetes versions.

• Documentation

• Added and refreshed docs for installation, parameters, snapshots, Outposts, plugins, node-local volumes, and IAM policies.

• Chores

• Updated Helm chart/app versions, images, tooling, and release notes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.