Ensure VPC CNI network policy support is enabled

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

v=$(aws eks describe-addon --cluster-name "${EKS_CLUSTER:?set EKS_CLUSTER}" --addon-name vpc-cni --query addon.configurationValues --output text 2>/dev/null) || v=$(kubectl get daemonset aws-node -n kube-system -o yaml) || exit 1
if printf '%s\n' "$v" | grep -Eqi 'enableNetworkPolicy"?[[:space:]]*:[[:space:]]*"?true|--enable-network-policy=true'; then echo compliant; else echo noncompliant; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Enable network policy support in the Amazon VPC CNI plugin for Kubernetes so EKS can enforce Kubernetes NetworkPolicy objects for Pod traffic. This feature is not enabled by default on newly provisioned clusters, and remediation requires a supported VPC CNI version plus network policy enabled in the VPC CNI configuration. For managed add-ons, set enableNetworkPolicy to true on the vpc-cni add-on. For self-managed installations, enable the network policy controller in the amazon-vpc-cni ConfigMap and set the aws-node DaemonSet argument --enable-network-policy=true. AWS CLI, managed add-on: Update the managed vpc-cni add-on and enable the feature. AWS’s current guide shows v1.14.0-eksbuild.3 or later in the example.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target eks