[EKS] [block IMDS on IPV6 cluster via Network policy]: The default deny all egress network policy doesn't block access to IMDS on IPV6 EKS cluster.
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
The default egress deny network policies doesn't block access to IMDS service on IPV6 EKS cluster.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
The below default deny all egress rule works just fine in EKS ipv4 cluster. It'll effectively block all egress traffic. Pod won't be able to reach internet as well as IMDS service which is expected.
However, when same network policies is applied in IPV6 cluster, pod won't be able to reach to internet which is expected. However, pod is still able to reach IMDS service.
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-egress
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress
```
I've a use case where some pods shouldn't reach to IMDS service. However, other pods need access to IMDS service. As such, I'm trying to implement network policies to block IMDS service to some selected pods.
**Are you currently working around this issue?**
There is no workaround as of now.
**Additional context**
Steps to reproduce:
1. Create IPV6 eks cluster as below:
```
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
name: my-test-ipv6
region: us-east-2
version: "1.29"
kubernetesNetworkConfig:
ipFamily: IPv6 # or IPv4
addons:
- name: vpc-cni
version: latest
- name: coredns
version: latest
- name: kube-proxy
version: latest
iam:
withOIDC: true
managedNodeGroups:
- name: mng1
```
2. Enable Network policy in eks cluster.
3. apply default deny all egress network policy mentioned above.
4. Launch some sample pod and exec into the pod.
5. try to reach internet and IMDS service (i.e., ```curl google.com```, ```curl -v http://169.254.169.254```).
6. Result: (pod can't reach internet. However, pod can still reach IMDS service)
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Start by reproducing the behavior with the provided eksctl ClusterConfig, enabling EKS network policy and applying the shown default-egress NetworkPolicy. Verify that internet access is blocked while IMDS remains reachable from an IPv6 pod; done means the policy also blocks IMDS access without preventing the expected egress restrictions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100