AWS eks documentation change
Summary
Added warning about conflicting names for ApplicationNetworkPolicy and NetworkPolicy
Security assessment
The change warns against naming collisions between policy types, which could lead to misconfigured network policies. While misconfigurations could indirectly impact security, there is no explicit mention of a security vulnerability or weakness being addressed.
Diff
diff --git a/eks/latest/userguide/auto-net-pol.md b/eks/latest/userguide/auto-net-pol.md index d8a15b273..ed5de5526 100644 --- a//eks/latest/userguide/auto-net-pol.md +++ b//eks/latest/userguide/auto-net-pol.md @@ -162 +162,9 @@ The `ApplicationNetworkPolicy` combines the capabilities of standard Kubernetes -**Important note** : DNS based rules defined using the `ApplicationNetworkPolicy` are only applicable to workloads running in EKS Auto Mode-launched EC2 instances. +###### Important + +DNS based rules defined using the `ApplicationNetworkPolicy` are only applicable to workloads running in EKS Auto Mode-launched EC2 instances. `ApplicationNetworkPolicy` supports all fields of the standard Kubernetes `NetworkPolicy`, with an additional FQDN filter for egress rules. + +###### Warning + +Do not use the same name for an `ApplicationNetworkPolicy` and a `NetworkPolicy` within the same namespace. If the names collide, the resulting `PolicyEndpoints` objects may not reflect either policy correctly. Both resources are accepted without error, making this issue difficult to diagnose. + +To resolve a naming conflict, rename either the `ApplicationNetworkPolicy` or the `NetworkPolicy` so they are unique within the namespace, then verify that the corresponding `PolicyEndpoints` objects are updated correctly.