openSUSE-SU-2026:22035-1

This update for amazon-ecs-init fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276744).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279329).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231).

Changes for amazon-ecs-init:

• Update to version 1.107.0

• Feature - Add MPS GPU Sharing capability (#5139)
• Enhancement - Add MPS control daemon health gate task resource (#5107)
• Enhancement - Surface MPS control-daemon impairment reason as StatusReason (#5125)
• Enhancement - Attach the MPS control daemon health gate to MPS tasks (#5119)
• Enhancement - Add ACCELERATED_COMPUTE health check for the MPS control daemon (#5124)
• Enhancement - Fetch GPG keys from S3 instead of GitHub in ECS Anywhere install script (#5130)
• Enhancement - Bump github.com/prometheus/common from 0.66.1 to 0.71.0 in /ecs-agent (#5117)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.32 to 1.20.4 in /agent (#5128)
• Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.35 in /ecs-init (#5133)
• Enhancement - Bump google.golang.org/grpc from 1.82.1 to 1.83.1, this also updated go.opentelemetry.io/otel to v1.44.0 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5123)
• Enhancement - Bump k8s.io/api from 0.28.1 to 0.37.0 in /agent (#5118)
• Enhancement - Correct broken systemd link in README (#5129)
• Enhancement - Bump golang.org/x/text and related dependencies (#5100)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.18.33 to 1.18.38 in /ecs-agent (#5093)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.35.2 to 1.44.7 in /agent (#5094)
• Enhancement - Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3 (#5108)
• Enhancement - Update Go version to 1.26.7 (#5105)
• Enhancement - Add amazon-ecs-agent.gpg and amazon-ssm-agent.gpg to the CodePipeline release artifacts (#5101)
• Enhancement - IMDS credentials scanner/refresher: Add logging and validations (#5091)
• Enhancement - Bump github.com/containerd/cgroups/v3 from 3.0.4 to 3.1.3 in /agent (#5081)
• Enhancement - Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /ecs-agent and /agent (#5085)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.29 to 1.19.32 in /ecs-agent, /agent and /ecs-init (#5080)
• Bugfix - fix(handlers): raise fault rate limit to 1 rps (#5092)
• Feature - Nvidia MPS GPU sharing (not yet enabled)
• Add MPS control-daemon health probe (#5095)
• Add per-GPU memory accounting to host resource manager (#5090)
• Allow MPS containers to colocate on a shared GPU (#5083)
• Mount MPS control binary and pipe dir into the agent container (#5086)
• Move MPS pipe directory to /run/mps-ecs (#5102)
• Enhancement - Add retry for EFS volume creation to handle plugin timeout errors caused by concurrent mount operation (#5077)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.32.23 to 1.32.31 in /agent (#5064)
• Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /ecs-agent/daemonimages/csidriver (#5056)
• Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1 in /ecs-agent (#5063)
• Enhancement - add nos3readcache S3 Files mount option (#5062)
• Add ecs.capability.gpu-sharing-mps capability for NVIDIA MPS GPU sharing (#5053)
• Inject NVIDIA MPS env vars and pipe mount into MPS containers (#5082)
• Map ACS GPU sharingStrategy onto the internal container model for MPS (#5076)
• Gate gpu-sharing-mps on complete per-GPU memory- (#5075) (#5075)
• Regenerate ACS model for GPU sharingStrategy and validate it (#5071)
• Report per-GPU memory at container instance registration for GPU sharing (#5061)
• Regenerate ECS SDK with gpuInfo on PlatformDevice (#5060)