Cluster add-on upgrades, with VPC CNI 1.23 and a monitoring stack refresh

We are rolling out another round of cluster add-on upgrades. It ships to non-production clusters first, with production to follow. This is a routine hygiene round: mostly patch and minor releases, and none of them need any action on your side.

What changed

• AWS VPC CNI 1.22 → 1.23. The CNI’s internal components now talk over a local socket instead of a TCP port on the node. This is plumbing inside the networking add-on; pod networking and network policies behave exactly as before.
• Monitoring stack refresh. kube-prometheus-stack moves to chart v88 (Prometheus Operator v0.93.0), bundling updated CRDs, kube-state-metrics v8 and a newer Grafana. The CRD updates are applied automatically by our GitOps setup; your dashboards and alerts keep working unchanged.
• metrics-server 0.8 → 0.9. Dependency and security (CVE) updates; resource metrics and autoscaling behavior are unchanged.

Add-on upgrades

• alloy v1.18.1 (chart v1.11.1)
• amazon-eks-ami v20260810
• aws-ebs-csi-driver v1.63.1
• aws-efs-csi-driver v3.4.1
• aws-load-balancer-controller v3.5.0
• aws-vpc-cni v1.23.0
  • Minor version bump; internal control-plane communication moved to a local socket. No change to pod networking or network policies.
• cert-manager v1.21.1
  • Fixes a controller panic and log-spam regression introduced in 1.21.0.
• eks-node-monitoring-agent v1.7.0
  • Adds instance-store I/O error detection for node auto-repair
• flux v2.9.4
• fluent-bit v5.1.0 (chart v0.58.0)
• keda v2.20.2
• kube-prometheus-stack v88.3.0 (Prometheus Operator v0.93.0)
  • Major chart version; the CRD update is applied automatically. Also bundles kube-state-metrics v8 and a newer Grafana. No dashboards or alerts change for you.
• grafana-loki v3.7.6 (chart v18.9.0)
• metrics-server v0.9.0
• prometheus-blackbox-exporter chart v11.17.2 (chart-only update, the exporter itself is unchanged)
• secrets-store-csi-driver-provider-aws chart v3.1.2
• tailscale-operator v1.102.2
• tempo v2.10.8 (chart v2.2.4)
• traefik v3.7.10 (chart v41.2.0)
• vertical-pod-autoscaler v1.7.1 (chart v0.11.0)
• wg-easy v15.4.0

We also picked up the latest EKS build revisions for kube-proxy and the snapshot-controller (packaging updates only, no version change).