feat(eks): enable VPC CNI NetworkPolicy enforcement (DND-1082)

[CRThaze]

User description

What

Adds eks_enable_network_policy (default true) and wires it into the vpc-cni managed addon as configuration_values = jsonencode({ enableNetworkPolicy = "true" }).

Why (DND-1082)

Audit of the STSaaS fleet found the vpc-cni addon has no configurationValues on every cluster → Kubernetes NetworkPolicy enforcement is off fleet-wide. NetworkPolicy objects are created but silently ignored — e.g. cisco's existing PP-engine egress policy (DND-1396) is currently inert. This flips the CNI on so the planned opik-python-backend / PP-engine / Ollie-engine egress policies actually take effect.

Behavior / rollout note

Default true means: on the next apply (or module-ref bump) for any consumer, the CNI node-agent (aws-eks-nodeagent) turns on. Enforcement is a safe superset — a NetworkPolicy only restricts pods it explicitly selects; pods with no matching policy stay fully open. The one live effect today is that cisco's existing PP-engine policy becomes enforced. Set eks_enable_network_policy = false per env to opt out.

Changes

• modules/comet_eks/main.tf — vpc-cni addon entry becomes a merge() that adds configuration_values = jsonencode({ enableNetworkPolicy = "true" }) when the toggle is on (still before_compute = true).
• modules/comet_eks/variables.tf + root variables.tf — new eks_enable_network_policy (bool, default true).
• root main.tf — passthrough into module "comet_eks".

Validation

CI (terraform_validate + tflint) covers this. Underlying terraform-aws-modules/eks/aws ~> 21.24.0 supports configuration_values on before_compute addons.

Note: README ## Inputs is terraform-docs-style but already stale (missing eks_enable_metrics_server and other recent eks_enable_* vars) and pre-commit does not run terraform-docs, so it was left untouched to match prior additions. Regenerate separately if desired.

Ref: DND-1082

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Enable Kubernetes NetworkPolicy enforcement in the comet_eks module by setting enableNetworkPolicy=true on the vpc-cni managed addon. Add and pass through the eks_enable_network_policy toggle, defaulting to true, so consumers can opt out while the root main.tf wires the new input into the module.

Topic	Details
Policy enforcement	Enable vpc-cni NetworkPolicy enforcement by merging addon configuration_values when eks_enable_network_policy is on. Modified files (1) modules/comet_eks/main.tf Latest Contributors(2) User Commit Date diego@crthaze.com feat(eks): enable VPC ... July 29, 2026 alexb@comet.com feat(eks): Auto Mode, ... July 28, 2026
Input wiring	Add the eks_enable_network_policy variable and thread it from the root module into comet_eks. Modified files (3) main.tf modules/comet_eks/variables.tf variables.tf Latest Contributors(2) User Commit Date diego@crthaze.com feat(eks): enable VPC ... July 29, 2026 darenjacobs@msn.com default rds_backup_ret... July 28, 2026

_{Review this PR on Baz | Customize your next review}

[jms200]

Looks good to me!