Amazon EKS VPC CNI network policy support should be enabled

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Amazon EKS clusters should enable VPC CNI network policy support so that Kubernetes NetworkPolicy objects enforce Pod-to-Pod traffic restrictions through the VPC CNI data path. This feature is not enabled by default and requires a supported vpc-cni add-on version with enableNetworkPolicy set to true; without it, namespace segmentation and least-privilege traffic controls are not applied.

Remediation

Update the managed vpc-cni add-on to a supported version and set enableNetworkPolicy to true in its configuration values, then apply the required Kubernetes NetworkPolicy objects. See Configure your cluster for Kubernetes network policies for the full procedure.

References