From b940ac068b5f06e6a336b9b9657a22944ea5dd70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Diego=20Fernando=20Carri=C3=B3n?= <diego@crthaze.com>
Date: Wed, 29 Jul 2026 16:10:12 +0200
Subject: [PATCH] feat(eks): enable VPC CNI NetworkPolicy enforcement
 (DND-1082)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add eks_enable_network_policy (default true), wired into the vpc-cni
managed addon as configuration_values={enableNetworkPolicy:"true"}.

Without this the CNI runs at AWS defaults and NetworkPolicy objects are
created but silently not enforced — so the opik-python-backend, PP-engine
and Ollie-engine egress policies (DND-1082) have no effect. Enforcement is
a safe superset: a NetworkPolicy only restricts pods it explicitly selects;
unselected pods remain fully open.

Overridable per env (set false to keep enforcement off).
---
 main.tf                        |  1 +
 modules/comet_eks/main.tf      | 11 ++++++++++-
 modules/comet_eks/variables.tf |  6 ++++++
 variables.tf                   |  6 ++++++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/main.tf b/main.tf
index 4f094cc..6190cbe 100644
--- a/main.tf
+++ b/main.tf
@@ -239,6 +239,7 @@ module "comet_eks" {
   eks_external_dns_addon_version               = var.eks_external_dns_addon_version
   eks_external_dns_r53_zones                   = var.eks_external_dns_r53_zones
   eks_enable_metrics_server                    = var.eks_enable_metrics_server
+  eks_enable_network_policy                    = var.eks_enable_network_policy
   eks_metrics_server_addon_version             = var.eks_metrics_server_addon_version
   eks_enable_kube_state_metrics                = var.eks_enable_kube_state_metrics
   eks_kube_state_metrics_addon_version         = var.eks_kube_state_metrics_addon_version
diff --git a/modules/comet_eks/main.tf b/modules/comet_eks/main.tf
index a04bf23..1dc753d 100644
--- a/modules/comet_eks/main.tf
+++ b/modules/comet_eks/main.tf
@@ -292,7 +292,16 @@ module "eks" {
     {
       # vpc-cni and kube-proxy are DaemonSets — not pinned to the system pool.
       # vpc-cni must be ready before nodes join, so provision it before compute.
-      vpc-cni    = { before_compute = true }
+      # DND-1082: when eks_enable_network_policy is set, turn on the CNI's
+      # Kubernetes NetworkPolicy enforcement (enableNetworkPolicy=true runs the
+      # aws-eks-nodeagent). NetworkPolicy objects are created-but-ignored until
+      # this is on. Off leaves the addon at AWS defaults (enforcement disabled).
+      vpc-cni = merge(
+        { before_compute = true },
+        var.eks_enable_network_policy ? {
+          configuration_values = jsonencode({ enableNetworkPolicy = "true" })
+        } : {}
+      )
       kube-proxy = {}
       # coredns is a schedulable Deployment — HA (2 replicas + PDB + soft
       # topology spread) plus system-pool pinning under Auto Mode. See the
diff --git a/modules/comet_eks/variables.tf b/modules/comet_eks/variables.tf
index 9b78846..78ff322 100644
--- a/modules/comet_eks/variables.tf
+++ b/modules/comet_eks/variables.tf
@@ -282,6 +282,12 @@ variable "eks_enable_metrics_server" {
   default     = true
 }
 
+variable "eks_enable_network_policy" {
+  description = "Enables Kubernetes NetworkPolicy enforcement in the VPC CNI managed addon (sets enableNetworkPolicy=true, which runs the aws-eks-nodeagent). Without it, NetworkPolicy objects are created but silently not enforced. Required for the opik-python-backend / PP-engine / Ollie-engine egress policies. Defaults to true — enforcement is a safe superset (policies only restrict pods they explicitly select; unselected pods stay fully open)."
+  type        = bool
+  default     = true
+}
+
 variable "eks_metrics_server_addon_version" {
   description = "Pinned version of the metrics-server EKS managed addon. Set to null to use the AWS default for the cluster's Kubernetes version."
   type        = string
diff --git a/variables.tf b/variables.tf
index 2180f1e..7310181 100644
--- a/variables.tf
+++ b/variables.tf
@@ -670,6 +670,12 @@ variable "eks_enable_metrics_server" {
   default     = true
 }
 
+variable "eks_enable_network_policy" {
+  description = "Enables Kubernetes NetworkPolicy enforcement in the VPC CNI managed addon (sets enableNetworkPolicy=true, which runs the aws-eks-nodeagent). Without it, NetworkPolicy objects are created but silently not enforced. Required for the opik-python-backend / PP-engine / Ollie-engine egress policies. Defaults to true — enforcement is a safe superset (policies only restrict pods they explicitly select; unselected pods stay fully open)."
+  type        = bool
+  default     = true
+}
+
 variable "eks_metrics_server_addon_version" {
   description = "Pinned version of the metrics-server EKS managed addon. Set to null to use the AWS default for the cluster's Kubernetes version."
   type        = string