AWS EKS Linkerd CNI - AWS CNI chaining - Control plane pods fail to startup. AL2023

[Viggy07]

We have been using Linkerd CNI in chaining mode along with AWS CNI to avoid having the init container and CAP_NET_ADMIN for the pods. But recently we are looking to migrate from Amazon Linux 2(AL2) to Amazon Linux 2023. We are creating a new EKS cluster with the Amazon Linux 2023 and bootstrap our Fluxcd to install Linkerd CNI, Linkerd Control plane and Linkerd Viz. We are currently using the version 25.2.3. With AL2023, the control plane components fail with the following error:

Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "e94dc34fa322595d2cf3614dad41909dc06d335788cd977c92d049b541e3560d": plugin type="linkerd-cni" name="linkerd-cni" failed (add): exit status 127

EKS Version: 1.32
Linkerd Version: 25.2.3 or 25.4.4 (Fails with the latest version as well)

We tried to take FluxCD out of the picture, installing with linkerd CLI, but it still fails. Please find the steps to reproduce the issue below.

Steps to reproduce the issue:

1. New EKS cluster (1.32) with recent version of AWS CNI installed.
2. EKS cluster should have managed Amazon linux 2023(AL2023) Node group
3. Install Linkerd-CNI with the linkerd CLI
   linkerd install-cni | kubectl apply -f -
4. Install linkerd control plane components with the CLI
   linkerd install --identity-trust-anchors-file ca.crt --identity-issuer-certificate-file issuer.crt --identity-issuer-key-file issuer.key --linkerd-cni-enabled | kubectl apply -f -

With the above the step, Linkerd control plane pods fail to come up with the error = failed (add): exit status 127.

linkerd check --pre comes up clean without any errors

Let me know if I am missing any flags while installing linkerd cni or control plane. Thank you for looking into this.

[Viggy07]

Switching the linkerd-cni helm chart value to iptablesMode: plain resolved the issue.