[EKS] [Feature Request]: Option to log all network flows to Cloudwatch without writing NetworkPolicies

[evanj80-illumio]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
I would like to propose a flag within the advanced configuration options to capture all network traffic without a network policy. Add the ability for the node-agent to listen and log all network flows to cloudwatch.

Which service(s) is this request for?
EKS

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
This would allow a user to have full visibility into not just traffic that occurs on a VPC within AWS but also traffic that happens within a cluster and within a node of that cluster.

Are you currently working around this issue?
A workaround I have found for now is to apply a network policy that allows all traffic in all namesspaces. This way the node-agent logs all flows as enforcement events and logs them to cloudwatch.

Define an array of namespaces where you want to allow all traffic
namespaces=("default" "kube-system")
Loop through each namespace and apply the Network Policy
for ns in "${namespaces[@]}"; do
  kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-traffic
  namespace: $ns
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - {}
  egress:
  - {}
EOF
done

The problem is then if I want to apply a network policy limiting traffic between 2 specific pods then I must reapply this same policy in every namespace but the namespace those 2 pods reside in. As policies become more complex this current implementation is not realistic or easy to maintain.