Skip to main content

Illumio Segmentation for Containers

Configure Amazon EKS Auto Mode Clusters for AWS VPC CNI Network Policy Flow Logs

This topic explains how to enable Network Policy event logs on Amazon EKS Auto Mode cluster nodes so that the Illumio cloud operator can collect network flow logs.

Amazon EKS Auto Mode automates Kubernetes cluster management for compute, storage, and networking on AWS.

Collecting the flow logs requires configuring two separate layers:

  • Cluster-level network policy support

  • Node-level network policy event logging

Configure Amazon EKS Auto Mode Clusters

  1. Enable the Network Policy Controller.

    Create or update the amazon-vpc-cni ConfigMap in kube-system:

    apiVersion: v1
kind: ConfigMap
metadata:
  name: amazon-vpc-cni
  namespace: kube-system
data:
  enable-network-policy-controller: "true"

    Apply the ConfigMap to enable Network Policy support at the cluster level.

    kubectl apply -f enable-network-policy.yaml

    This enables Network Policy support at the cluster level.

    Caution

    Do not use the managed vpc-cni EKS add-on configuration to enable event logging on Amazon EKS Auto Mode. AWS manages the VPC CNI and its Network Policy Agent, which silently ignores settings such as enableNetworkPolicyEventLogs and enablePolicyEventLogs in the add-on’s Advanced configuration. The agent would continue to report EnableNetworkPolicyEventLogs: false.

    To enable event logging, configure both:

    • The ConfigMap described in Step 1.

    • The NodeClass described in Step 2.

  2. Enable Network Policy event logs on the NodeClass.

    The nodes that produce Network Policy event logs must use a NodeClass containing:

    spec:
  networkPolicyEventLogs: Enabled

    1. If you already use a custom NodeClass, patch the existing one.

      kubectl patch nodeclass <your-nodeclass> --type merge \
  -p '{"spec":{"networkPolicyEventLogs":"Enabled"}}'

      Validate the NodeClass

      2. kubectl get nodeclass <your-nodeclass> -o yaml

      Confirm the NodeClass by

      networkPolicyEventLogs: Enabled

    2. If you use the AWS-managed default NodeClass, create a custom NodeClass.

      Important

      Do not modify the AWS-managed default NodeClass. Create a custom NodeClass with the same required networking and role settings, and add event logging.

      apiVersion: eks.amazonaws.com/v1
kind: NodeClass
metadata:
  name: network-policy-logs
spec:
  role: <node-role>
  networkPolicyEventLogs: Enabled
  subnetSelectorTerms:
    # copy from the existing/default NodeClass
  securityGroupSelectorTerms:
    # copy from the existing/default NodeClass

      Create or use a custom NodePool that references the new custom NodeClass.

      apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: network-policy-logs
spec:
  template:
    spec:
      nodeClassRef:
        group: eks.amazonaws.com
        kind: NodeClass
        name: network-policy-logs

      New nodes created from that NodePool will use the custom NodeClass configuration.

  3. Verify that event logging is enabled on a node.

    1. List the nodes:

      kubectl get nodes

    2. Inspect the Network Policy Agent log for a node:

      kubectl get --raw \
  "/api/v1/nodes/<node-name>/proxy/logs/aws-routed-eni/network-policy-agent.log" \
  | grep NetworkPolicyAgentConfig

    The expected output should indicate:

    EnableNetworkPolicyEventLogs: true

    If it indicates false, that node does not use a NodeClass with Network Policy event logging enabled.

Logs collected by the operator

The operator collects only the Network Policy Agent log and its rotated generations.

EXAMPLE:

/var/log/aws-routed-eni/network-policy-agent.log
/var/log/aws-routed-eni/network-policy-agent-<timestamp>.log
/var/log/aws-routed-eni/network-policy-agent-<timestamp>.log.gz