Support for EKS Load Balancer
We add support for load balancer services in EKS. The CSW agents enforce rules on consumer hosts and provider hosts/pods.
An EKS Load Balancer has two options:
-
Preserve Client IP.
-
On provider pod, we generate
-
Target Type.
Before starting with cases, for the following policy intent:
Consumer to provider service, service protocol and port with allow action rules for various cases are generated as follows:
|
Case |
Preserve Client |
Target Type |
|---|---|---|
|
1 |
On |
IP |
|
2 |
On |
Instance |
|
3 |
Off |
IP |
|
4 |
Off |
Instance |
Case 1:
On consumer node we generate an egress rule with consumer to load balancer service (lb ingress ip) service protocol and port allow.
There are no host rules on the provider node, but we generate an Ingress rule on the provider pod with source as the consumer, the destination as provider pod (any), the protocol as the target protocol, the port as the target port, and the action as allow.
Case 2:
On consumer node we generate an egress rule with consumer to load balancer service (lb ingress ip) service protocol and port allow.
On provider node there is a prerouting rule generated with source as consumer and destination as all provider nodes, protocol as service protocol, port as node port of the service and an action as allow.
On provider pod, we generate an Ingress rule with source as provider nodes, destination as provider pod (any), protocol as target protocol, port as target port and action as allow.
Case 3:
On consumer node we generate an egress rule with consumer to load balancer service (lb ingress ip) service protocol and port allow.
There are no host rules on the provider node. On provider pod, we generate an Ingress rule with source as lb ingress ip's destination as provider pod (any), protocol as target protocol, port as target port and action as allow.
Case 4:
On consumer node we generate an egress rule with consumer to load balancer service(lb ingress ip) service protocol and port allow.
The provider node generates a prerouting rule that sets the lb ingress IPs as the source and all provider nodes as the destination. The rule specifies the service protocol as the protocol and the node port of the service as the port, with the action set to allow.
On provider pod, we generate an Ingress rule with source as provider nodes, destination as provider pod (any), protocol as target protocol, port as target port and action as allow.