[EKS] [Feature Request]: Support additional rules and dont limit to 24 rules in network policies.
Opened this issue · 0 comments
Community Note
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Tell us about your request
Support additional rules and remove the 24 unique ports per protocol per pod selector rule in networkpolicies for vpc-cni
Which service(s) is this request for?
This request is for EKS VPC CNI add-on specifically network policies maximum unique ports limitation per protocol per pod selector
Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
As of now, in network policies matching selector, we can add a maximum of 24 rules, and each rule can have port range defined. As an example,
- port: 8080
endPort: 29111
protocol: TCP
similar to above, we can add 24 rules with port range defined for a selector.
If you have more port ranges to be whitelisted for example, if you need to allow few ports in 1000 range, few more in 2000 range and so on, and if we proceed similarly it may exceed 24 ports. Due to limitation of VPC CNI, it may not be achievable as told before. To achive this, we need to allow broder range of ports which is not a best practice.
Are you currently working around this issue?
I'm currently working with port ranges. However, from a security perspective and future requirements, this is not a feasible approach
Additional context
Anything else we should know?
We opened a support ticket with ID 173208198600926