Cannot deploy linkerd-cni v2025.3.1

[jdinsel-xealth]

What is the issue?

Version 2025.3.1 fails to start in our AWS EKS cluster. It has the same error as #13760, but different versions of linkerd-cni.

How can it be reproduced?

Deploy the helm chart for linkerd-cni v2025.3.1 to an EKS cluster already running linkerd-cni v2025.2.3.

Logs, error output, etc

This k8s event is associated with the first linkerd-cni pod started as part of the DaemonSet rollout.

5m13s       Warning   FailedCreatePodSandBox   pod/linkerd-cni-ltrn6   Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "41b3c75a4675a1d9b923e011ae1d4ba1c11792ffe67bbcf73d443bfbeb58111b": plugin type="linkerd-cni" name="linkerd-cni" failed (add): Unauthorized

output of linkerd check -o short

This command doesn't complete because the rollout is stuck on the first pod.

Environment

• Kubernetes version: AWS 1.31
• Linkerd Version: v2.17.1
• Linkerd CNI version: v2025.3.1

Possible solution

No response

Additional context

I've attempted to replace one node during the upgrade, but have not been successful in getting this version of linkerd to start.

Would you like to work on fixing this bug?

None

[alpeb]

This should have worked when deployed into new nodes, but as per your comment in #13760 that was not the case for you. Can you please post the contents of the cni config file located under the directory /etc/cni/net.d/ in your node?

[jdinsel-xealth]

There are three files in the EC2 instance:

05-cilium.conflist  10-aws.conflist  ZZZ-linkerd-cni-kubeconfig

These are the same files when the node is newly created. I redacted only two lines from the file. As far as I can tell, these files are nearly identical between the two versions (v1.6.0 and v1.6.2).

# Kubeconfig file for linkerd CNI plugin.
apiVersion: v1
kind: Config
clusters:
- name: local
  cluster:
    server: https://[172.20.0.1]:443
    certificate-authority-data: redacted
users:
- name: linkerd-cni
  user:
    token: token_redacted
contexts:
- name: linkerd-cni-context
  context:
    cluster: local
    user: linkerd-cni
current-context: linkerd-cni-context

[alpeb]

If the conflist files contain an entry for linkerd-cni under the plugins array, you should remove it, and try restarting the linkerd-cni pod again.

[jdinsel-xealth]

It does and it is a reference to the aforementioned ZZZ-linkerd-cni-kubeconfig file. The instructions were not clear if the file should be edited (there aren't many tools on bottlerocket to accomplish that) or to remove the file. Removing the file and restarting the pod resulted in the same Unauthorized error.