aws / aws/containers-roadmap

[EKS] [Feature Request]: Support additional rules and dont limit to 24 rules in network policies.

Open
#2,481 2 comments 0 reactions 0 assignees View on GitHub
EKS EKS Networking Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Support additional rules and remove the 24 unique ports per protocol per pod selector rule in networkpolicies for vpc-cni

**Which service(s) is this request for?**
This request is for EKS VPC CNI add-on specifically network policies maximum unique ports limitation per protocol per pod selector

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
As of now, in network policies matching selector, we can add a maximum of 24 rules, and each rule can have port range defined. As an example,
- port: 8080
endPort: 29111
protocol: TCP

similar to above, we can add 24 rules with port range defined for a selector.

If you have more port ranges to be whitelisted for example, if you need to allow few ports in 1000 range, few more in 2000 range and so on, and if we proceed similarly it may exceed 24 ports. Due to limitation of VPC CNI, it may not be achievable as told before. To achive this, we need to allow broder range of ports which is not a best practice.

**Are you currently working around this issue?**
I'm currently working with port ranges. However, from a security perspective and future requirements, this is not a feasible approach

**Additional context**
Anything else we should know?
We opened a support ticket with ID 173208198600926

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the EKS VPC CNI network policy implementation and its handling of unique ports per protocol and pod selector. Confirm where the 24-rule limit is enforced and identify the existing network policy tests or documentation for this limitation. Done means supporting additional rules without requiring broader port ranges, with coverage for multiple port ranges and protocols.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.