feat(eks): enable VPC CNI NetworkPolicy enforcement (DND-1082)

main.tf

@@ -239,6 +239,7 @@ module "comet_eks" {
   eks_external_dns_addon_version               = var.eks_external_dns_addon_version
   eks_external_dns_r53_zones                   = var.eks_external_dns_r53_zones
   eks_enable_metrics_server                    = var.eks_enable_metrics_server
+  eks_enable_network_policy                    = var.eks_enable_network_policy
   eks_metrics_server_addon_version             = var.eks_metrics_server_addon_version
   eks_enable_kube_state_metrics                = var.eks_enable_kube_state_metrics
   eks_kube_state_metrics_addon_version         = var.eks_kube_state_metrics_addon_version

modules/comet_eks/main.tf

@@ -292,7 +292,16 @@ module "eks" {
     {
       # vpc-cni and kube-proxy are DaemonSets — not pinned to the system pool.
       # vpc-cni must be ready before nodes join, so provision it before compute.
-      vpc-cni    = { before_compute = true }
+      # DND-1082: when eks_enable_network_policy is set, turn on the CNI's
+      # Kubernetes NetworkPolicy enforcement (enableNetworkPolicy=true runs the
+      # aws-eks-nodeagent). NetworkPolicy objects are created-but-ignored until
+      # this is on. Off leaves the addon at AWS defaults (enforcement disabled).
+      vpc-cni = merge(
+        { before_compute = true },
+        var.eks_enable_network_policy ? {
+          configuration_values = jsonencode({ enableNetworkPolicy = "true" })
+        } : {}
+      )
       kube-proxy = {}
       # coredns is a schedulable Deployment — HA (2 replicas + PDB + soft
       # topology spread) plus system-pool pinning under Auto Mode. See the

modules/comet_eks/variables.tf

@@ -282,6 +282,12 @@ variable "eks_enable_metrics_server" {
   default     = true
 }
 
+variable "eks_enable_network_policy" {
+  description = "Enables Kubernetes NetworkPolicy enforcement in the VPC CNI managed addon (sets enableNetworkPolicy=true, which runs the aws-eks-nodeagent). Without it, NetworkPolicy objects are created but silently not enforced. Required for the opik-python-backend / PP-engine / Ollie-engine egress policies. Defaults to true — enforcement is a safe superset (policies only restrict pods they explicitly select; unselected pods stay fully open)."
+  type        = bool
+  default     = true
+}
+
 variable "eks_metrics_server_addon_version" {
   description = "Pinned version of the metrics-server EKS managed addon. Set to null to use the AWS default for the cluster's Kubernetes version."
   type        = string

variables.tf

@@ -670,6 +670,12 @@ variable "eks_enable_metrics_server" {
   default     = true
 }
 
+variable "eks_enable_network_policy" {
+  description = "Enables Kubernetes NetworkPolicy enforcement in the VPC CNI managed addon (sets enableNetworkPolicy=true, which runs the aws-eks-nodeagent). Without it, NetworkPolicy objects are created but silently not enforced. Required for the opik-python-backend / PP-engine / Ollie-engine egress policies. Defaults to true — enforcement is a safe superset (policies only restrict pods they explicitly select; unselected pods stay fully open)."
+  type        = bool
+  default     = true
+}
+
 variable "eks_metrics_server_addon_version" {
   description = "Pinned version of the metrics-server EKS managed addon. Set to null to use the AWS default for the cluster's Kubernetes version."
   type        = string