Profile applicability: Level 1 - Cluster / Control Plane
Ensure that Network Policy is enabled and set appropriately when creating an Amazon
EKS cluster, as the network policy option selected at creation cannot be changed later.
Amazon EKS supports Calico Network Policies, an open-source solution that uses Linux
IPTables to enforce network security policies. These policies are translated into
rules that allow or disallow traffic between IP pairs, effectively acting as a pod-level
firewall that restricts traffic between sources within a cluster. By default, pod-to-pod
traffic is unrestricted within a cluster unless a Network Policy that uses labels
to select specific pods is implemented.
Once a policy is applied to a pod, it will block any connections not explicitly allowed
by the policy, while pods not selected by any Network Policy will continue to accept
all traffic. Network Policies are managed via the Kubernetes Network Policy API and
must be enforced by a compatible network plugin; without this, creating the resource
alone will have no effect. Enabling Network Policy requires the Network Policy add-on,
which is automatically included when a new cluster is set up with Network Policy but
must be added manually to existing clusters. The process of enabling or disabling
Network Policy triggers a rolling update of all cluster nodes, a long operation that
blocks other cluster operations until complete. Additionally, enforcing Network Policy
consumes extra node resources, increasing the memory footprint of the kube-system
process by approximately 128MB and requiring about 300 millicores of CPU.
Impact
Network Policy requires the Network Policy add-on. This add-on is included automatically
when a cluster with Network Policy is created, but for an existing cluster, it needs
to be added before enabling Network Policy.
Enabling or disabling Network Policy causes a rolling update of all cluster nodes,
similar to performing a cluster upgrade. This operation is long-running and will block
other operations on the cluster (including delete) until it has completed.
Enabling Network Policy enforcement consumes additional resources in nodes, increasing
the memory footprint of the kube-system process by approximately 128MB, and requiring
around 300 millicores of CPU.
Audit
Check for the following is not null and set with the appropriate group id:
export CLUSTER_NAME=<your cluster name>
aws eks describe-cluster --name ${CLUSTER_NAME} --query "cluster.resourcesVpcConfig.clusterSecurityGroupId"
Remediation
Utilize Calico or another network policy engine to segment and isolate your traffic.