aws / aws/containers-roadmap

[EKS] [block IMDS on IPV6 cluster via Network policy]: The default deny all egress network policy doesn't block access to IMDS on IPV6 EKS cluster.

Open
#2,440 0 comments 3 reactions 0 assignees View on GitHub
EKS EKS Networking Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
The default egress deny network policies doesn't block access to IMDS service on IPV6 EKS cluster.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

The below default deny all egress rule works just fine in EKS ipv4 cluster. It'll effectively block all egress traffic. Pod won't be able to reach internet as well as IMDS service which is expected.
However, when same network policies is applied in IPV6 cluster, pod won't be able to reach to internet which is expected. However, pod is still able to reach IMDS service.

```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-egress
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress

```

I've a use case where some pods shouldn't reach to IMDS service. However, other pods need access to IMDS service. As such, I'm trying to implement network policies to block IMDS service to some selected pods.

**Are you currently working around this issue?**
There is no workaround as of now.

**Additional context**
Steps to reproduce:
1. Create IPV6 eks cluster as below:
```
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
name: my-test-ipv6
region: us-east-2
version: "1.29"

kubernetesNetworkConfig:
ipFamily: IPv6 # or IPv4

addons:
- name: vpc-cni
version: latest
- name: coredns
version: latest
- name: kube-proxy
version: latest

iam:
withOIDC: true
managedNodeGroups:
- name: mng1
```

2. Enable Network policy in eks cluster.
3. apply default deny all egress network policy mentioned above.
4. Launch some sample pod and exec into the pod.
5. try to reach internet and IMDS service (i.e., ```curl google.com```, ```curl -v http://169.254.169.254```).
6. Result: (pod can't reach internet. However, pod can still reach IMDS service)

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the behavior with the provided eksctl ClusterConfig, enabling EKS network policy and applying the shown default-egress NetworkPolicy. Verify that internet access is blocked while IMDS remains reachable from an IPv6 pod; done means the policy also blocks IMDS access without preventing the expected egress restrictions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.