Support enabling NetworkPolicy enforcement via eksctl cluster config

[consideRatio]

aws-node v1.14.0+ supports NetworkPolicy enforcement according to changelog. I'd love to be able to control enabling this or not via the eksctl configuration.

There is a documented way to enable this both for being a managed addon and for self-managed addons.

I understand that eksctl clusters provide aws-node aka. vpc-cni as a self-managed addon, not listed under addons in the eksctl configuration file, and should therefor follow documentation about enabling it for self-managed addon. I've so far tried and failed, and I'm not sure what goes on - but thats a separate topic to being allowed to enable it via .

Overall though, it would be great to be able to enable NetworkPolicy enforcement directly through the eksctl cluster configuration and not require manual kubectl patches, especially since these will would get replaced if we would use eksctl utils update-aws-node later at some point in time.

[consideRatio]

Related

• Update aws-node from 1.12.6 to 1.18.1 #7756
• Fix Github workflow for updating generated files for default addons #7766

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[consideRatio]

Stale but very relevant feature request of notable value i think

[consideRatio]

I think the path forward here is to declare that this won't be supported for the eksctl way of installing a EKS self-managed vpc-cni addon, and instead ask that users transition to installing it under addons so it becomes an EKS managed installation.

Like this, it can (I think, not tested) be configured according to official AWS docs written for eksctl config that has installed it under addons, with a quite trivial change looking like this:

 addons:
   - name: vpc-cni
+    configurationValues: |-
+      enableNetworkPolicy: "true"

Caveats

1. I've not yet transitioned any EKS cluster I maintain to installing the vpc-cni addon as a EKS managed addon via addons eksctl config yet. I think its sufficient to start listing it there though, and a transition will be made - where one can also declare resolveConflicts: overwrite, but I'm not sure.
2. I've not yet verified that it works as simple as below once that is done, but I recall it was to be explicitly enabled like this from somewhere:

    addons:
      - name: vpc-cni
   +    configurationValues: |-
   +      enableNetworkPolicy: "true"