aws
[EKS] [request]: DNS based policy support
Community Note
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Tell us about your request Native capabilities to allow and restrict traffic based on DNS names.
Which service(s) is this request for? EKS
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard? DNS based policies allow us to control traffic using DNS names, that are human readable and easier to manage than IP addresses. Looking for native support in the default EKS networking plugin to implement these policies.
Are you currently working around this issue? Installing third party plugins that result in operational overhead.
Additional context
Would this be solved with AdminNetworkPolicy in #2243, which supports controlling egress by FQDN?
I'm willing to bet that a lot of people move to Cilium because of this missing feature. Surprised there's not more likes on the issue
We're currently running EKS with Cilium (without kube-proxy replacement).
We wanted to leverage additional features like IPVS and LC, but unfortunately, they're not fully supported in this setup. Despite these limitations, we can't deprecate Cilium solely because EKS doesn't natively support FQDN-based network policies.
If EKS could provide native support for this, we'd be able to simplify our setup and fully adopt the AWS CNI. GKE already supports this, so we’re really hoping to see it on EKS as well.
Looking forward to any updates!
It’s surprising that AWS hasn’t started addressing this yet; the delay will likely push more users to abandon VPC CNI and explore alternative CNI solutions.
@zerodaywolf and everyone else looking for a similar egress network policy solution, I've released a lightweight kubernetes controller for this exact purpose: https://github.com/konsole-is/fqdn-controller
Hope it helps!
Any update? This is a quite common feature people use with alternative CNI solutions. It would be great if VPC CNI supports it.
