eksctl: add note about failing netpol enforcement

2i2c-org · Sep 10, 2024 · c7d530e · c7d530e
1 parent 27f5ab2
commit c7d530e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/eksctl/nmfs-openscapes.jsonnet b/eksctl/nmfs-openscapes.jsonnet
@@ -91,10 +91,13 @@ local daskNodes = [];
         [
             {
                 name: "vpc-cni",
+                # FIXME: network policy enforcement doesn't work, what's wrong
+                #        isn't clear.
                 # configurationValues ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/HEAD/charts/aws-vpc-cni/values.yaml
                 configurationValues: |||
                     enableNetworkPolicy: "true"
                 |||,
+                attachPolicyARNs: ["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"],
             },
             { name: "coredns" },
             { name: "kube-proxy" },

diff --git a/eksctl/template.jsonnet b/eksctl/template.jsonnet
@@ -89,10 +89,13 @@ local daskNodes = [];
         [
             {
                 name: "vpc-cni",
+                # FIXME: network policy enforcement doesn't work, what's wrong
+                #        isn't clear.
                 # configurationValues ref: https://github.com/aws/amazon-vpc-cni-k8s/blob/HEAD/charts/aws-vpc-cni/values.yaml
                 configurationValues: |||
                     enableNetworkPolicy: "true"
                 |||,
+                attachPolicyARNs: ["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"],
             },
             { name: "coredns" },
             { name: "kube-proxy" },