diff --git a/patterns/aws-vpc-cni-network-policy/README.md b/patterns/aws-vpc-cni-network-policy/README.md index efbf362326..1a41550939 100644 --- a/patterns/aws-vpc-cni-network-policy/README.md +++ b/patterns/aws-vpc-cni-network-policy/README.md @@ -1,10 +1,15 @@ -# Amazon EKS Cluster w/ ArgoCD +# Amazon EKS Cluster w/ Network Policies -This pattern demonstrates an EKS cluster that uses the native Network Policy support provided by the AWS VPC CNI (v1.14.0 or higher). +This pattern demonstrates an EKS cluster that uses the native Network Policy support provided by the Amazon VPC CNI (1.14.0 or higher). -- [Documentation](https://argo-cd.readthedocs.io/en/stable/) -- [EKS Blueprints Add-ons Repo](https://github.com/aws-samples/eks-blueprints-add-ons) -- [EKS Blueprints Workloads Repo](https://github.com/aws-samples/eks-blueprints-workloads) +- [Documentation](https://docs.aws.amazon.com/eks/latest/userguide/cni-network-policy.html) +- [Launch Blog](https://aws.amazon.com/blogs/containers/amazon-vpc-cni-now-supports-kubernetes-network-policies/) + +## Scenario + +This pattern deploys an Amazon EKS Cluster with Network Policies support implemented by the Amazon VPC CNI. Further it deploys a simple demo application (distributed as a Helm Chart) and some sample Network Policies to restrict the traffic between different components of the application. + +For a detailed description of the demo application and the Network Policies, please refer to the Stars demo of network policy section in the official [Documentation](https://docs.aws.amazon.com/eks/latest/userguide/cni-network-policy.html). ## Deploy @@ -37,7 +42,7 @@ See [here](https://aws-ia.github.io/terraform-aws-eks-blueprints/getting-started kubectl get service/management-ui -n management-ui ``` - Open the browser based on the URL obtained from the previous step to see the connection map. + Open the browser based on the URL obtained from the previous step to see the connection map and restrictions put in place by the Network Policies deployed. ## Destroy diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/.helmignore b/patterns/aws-vpc-cni-network-policy/charts/demo-application/.helmignore similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/.helmignore rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/.helmignore diff --git a/patterns/aws-vpc-cni-network-policy/charts/demo-application/Chart.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/Chart.yaml new file mode 100644 index 0000000000..7a8d00dd4e --- /dev/null +++ b/patterns/aws-vpc-cni-network-policy/charts/demo-application/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: demo-application +description: A Helm chart to deploy the demo-application +type: application +version: 1.0.0 \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/templates/deploy.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/backend-deploy.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/templates/deploy.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/backend-deploy.yaml diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/templates/svc.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/backend-svc.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/templates/svc.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/backend-svc.yaml diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/templates/deploy.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-deploy.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/client/templates/deploy.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-deploy.yaml diff --git a/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-ns.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-ns.yaml new file mode 100644 index 0000000000..91f714e9cb --- /dev/null +++ b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-ns.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: client + labels: + role: client \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/templates/svc.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-svc.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/client/templates/svc.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-svc.yaml diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/templates/deploy.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/frontend-deploy.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/templates/deploy.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/frontend-deploy.yaml diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/templates/svc.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/frontend-svc.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/templates/svc.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/frontend-svc.yaml diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/templates/deploy.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-deploy.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/templates/deploy.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-deploy.yaml diff --git a/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-ns.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-ns.yaml new file mode 100644 index 0000000000..ef0a8ec158 --- /dev/null +++ b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-ns.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: management-ui + labels: + role: management-ui \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/templates/svc.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-svc.yaml similarity index 100% rename from patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/templates/svc.yaml rename to patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-svc.yaml diff --git a/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/stars-ns.yaml b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/stars-ns.yaml new file mode 100644 index 0000000000..de71efa857 --- /dev/null +++ b/patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/stars-ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: stars \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/Chart.yaml b/patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/Chart.yaml deleted file mode 100644 index 9bb1dfbeef..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/backend/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: backend -description: A Helm chart to deploy the backend -type: application -version: 1.0.0 \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/.helmignore b/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/.helmignore deleted file mode 100644 index 0e8a0eb36f..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/Chart.yaml b/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/Chart.yaml deleted file mode 100644 index f608dbf0c4..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/client/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: client -description: A Helm chart to deploy the client -type: application -version: 1.0.0 \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/.helmignore b/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/.helmignore deleted file mode 100644 index 0e8a0eb36f..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/Chart.yaml b/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/Chart.yaml deleted file mode 100644 index 2fa4184aec..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/frontend/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: frontend -description: A Helm chart to deploy the frontend -type: application -version: 1.0.0 \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/.helmignore b/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/.helmignore deleted file mode 100644 index 0e8a0eb36f..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/Chart.yaml b/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/Chart.yaml deleted file mode 100644 index 93253b567b..0000000000 --- a/patterns/aws-vpc-cni-network-policy/demo-application/charts/management-ui/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: management-ui -description: A Helm chart to deploy the management-ui -type: application -version: 1.0.0 \ No newline at end of file diff --git a/patterns/aws-vpc-cni-network-policy/main.tf b/patterns/aws-vpc-cni-network-policy/main.tf index 28cbb42d12..3d7dc2e321 100644 --- a/patterns/aws-vpc-cni-network-policy/main.tf +++ b/patterns/aws-vpc-cni-network-policy/main.tf @@ -68,26 +68,6 @@ module "eks" { cluster_name = local.name cluster_version = "1.27" # Must be 1.25 or higher cluster_endpoint_public_access = true - cluster_ip_family = "ipv4" # Must be ipv4 or ipv6 - - # EKS Addons - cluster_addons = { - coredns = {} - kube-proxy = {} - vpc-cni = { - preserve = true - most_recent = true - - timeouts = { - create = "25m" - delete = "10m" - } - - configuration_values = jsonencode({ - enableNetworkPolicy : "true", - }) - } - } vpc_id = module.vpc.vpc_id subnet_ids = module.vpc.private_subnets @@ -135,73 +115,55 @@ module "vpc" { } ################################################################################ -# Demo application +# EKS Addons (demo application) ################################################################################ -resource "kubectl_manifest" "management_ui_namespace" { - yaml_body = <