Please vote on this issue by adding a đź‘Ť reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment
Tell us about your request
I would like to propose a flag within the advanced configuration options to capture all network traffic without a network policy. Add the ability for the node-agent to listen and log all network flows to cloudwatch.
Which service(s) is this request for?
EKS
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
This would allow a user to have full visibility into not just traffic that occurs on a VPC within AWS but also traffic that happens within a cluster and within a node of that cluster.
Are you currently working around this issue?
A workaround I have found for now is to apply a network policy that allows all traffic in all namesspaces. This way the node-agent logs all flows as enforcement events and logs them to cloudwatch.
Define an array of namespaces where you want to allow all traffic
namespaces=("default" "kube-system")
Loop through each namespace and apply the Network Policy
for ns in "${namespaces[@]}"; do
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-traffic
namespace: $ns
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- {}
egress:
- {}
EOF
done
The problem is then if I want to apply a network policy limiting traffic between 2 specific pods then I must reapply this same policy in every namespace but the namespace those 2 pods reside in. As policies become more complex this current implementation is not realistic or easy to maintain.
Community Note
Tell us about your request I would like to propose a flag within the advanced configuration options to capture all network traffic without a network policy. Add the ability for the node-agent to listen and log all network flows to cloudwatch.
Which service(s) is this request for? EKS
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard? This would allow a user to have full visibility into not just traffic that occurs on a VPC within AWS but also traffic that happens within a cluster and within a node of that cluster.
Are you currently working around this issue? A workaround I have found for now is to apply a network policy that allows all traffic in all namesspaces. This way the node-agent logs all flows as enforcement events and logs them to cloudwatch.
The problem is then if I want to apply a network policy limiting traffic between 2 specific pods then I must reapply this same policy in every namespace but the namespace those 2 pods reside in. As policies become more complex this current implementation is not realistic or easy to maintain.