Issues

Agent restart programs pods from a partial policy set until every PolicyEndpoint is reconciled

aws/aws-network-policy-agent#765 · opened

on Nov 6, 2026

Rules whose masked network address equals the node IP are dropped, so a ClusterNetworkPolicy Deny is not enforced on that node

aws/aws-network-policy-agent#749 · opened

on Nov 4, 2026

Conntrack cleanup reads the whole kernel conntrack table into memory every cleanup period; agent memory scales with node table size

aws/aws-network-policy-agent#746 · opened

on Nov 2, 2026

CNI ADD can return success while the pod's shared eBPF maps have no pod_state entries

aws/aws-network-policy-agent#744 · opened

on Nov 2, 2026

Except lists are merged across rules that share a CIDR, so one rule's except removes another rule's ports

aws/aws-network-policy-agent#743 · opened

on Nov 2, 2026

IPv4-mapped ipBlock CIDRs are canonicalized after the prefix-length sort, producing wrong port sets

aws/aws-network-policy-agent#742 · opened

on Nov 2, 2026

podIdentifierToPolicyEndpointMap keeps a dead slice name for non-local identifiers after a multi-slice policy is deleted

aws/aws-network-policy-agent#740 · opened

on Nov 2, 2026

Pod CNI ADD fails with "no active filter to detach" when another agent installs the clsact qdisc concurrently

aws/aws-network-policy-agent#733 · opened

on Nov 1, 2026

Make ParentRef key available for every reconcile event

aws/aws-network-policy-agent#728 · opened

on Oct 29, 2026

· v1.5.0

1

Add pod/namespace and port labels to network_policy_drop_count_total (and network_policy_drop_bytes_total)

aws/aws-network-policy-agent#725 · opened

on Oct 27, 2026

deriveTargetPodsForParentNP continues with an empty PolicyEndpoint on non-NotFound Get errors

aws/aws-network-policy-agent#723 · opened

on Oct 27, 2026

· v1.5.0

1

removeDuplicateL4Rules keys on *Protocol pointer address, so duplicate cluster policy L4 rules are never removed

aws/aws-network-policy-agent#722 · opened

on Oct 27, 2026

Cluster policy rule processing grows exponentially when a CIDR repeats across rules

aws/aws-network-policy-agent#721 · opened

on Oct 27, 2026

Standard mode: new pod's first egress packet dropped while policies attach under a namespace egress default-deny (v1.4.3)

aws/aws-network-policy-agent#699 · opened

on Oct 11, 2026

2

Standard mode: start pods isolated when the namespace has a NetworkPolicy with an empty podSelector

aws/aws-network-policy-agent#691 · opened

on Sep 29, 2026

2

Pod state map update fails with EINVAL after a partial BPF load is accepted as success

aws/aws-network-policy-agent#674 · opened

on Sep 9, 2026

CronJob pods with names truncated to 63 chars share one podIdentifier across all runs; overlapping runs lose return traffic (ingress BPF_DROP) until the shared program is unpinned

aws/aws-network-policy-agent#671 · opened

on Sep 4, 2026

Expose NetworkPolicy Attribution in Network Policy Agent Flow Logs

aws/aws-network-policy-agent#664 · opened

on Aug 27, 2026

Allow configuring the Kubernetes API server endpoint to avoid kube-proxy startup dependency

aws/aws-network-policy-agent#659 · opened

on Aug 19, 2026

4

Validate pinned BPF map schemas at startup

aws/aws-network-policy-agent#651 · opened

on Aug 13, 2026

LoadBpfFile returns success with an incomplete map set; pod_state write then fails with EINVAL and the pod is isolated

aws/aws-network-policy-agent#646 · opened

on Aug 10, 2026

2

Proposed node-agent orphan-GC

aws/aws-network-policy-agent#620 · opened

on Jul 21, 2026

1

Recreated same-named Job pods inherit stale NetworkPolicy enforcement via podIdentifier after pod-template labels change to be exempt (standard mode)

aws/aws-network-policy-agent#616 · opened

on Jul 14, 2026

Make flow-event log level configurable per verdict (ACCEPT / DENY)

aws/aws-network-policy-agent#601 · opened

on Jul 1, 2026

2

Expose reconciliation metrics (Prometheus/CloudWatch)

aws/aws-network-policy-agent#589 · opened

on May 31, 2026

Navigation Menu

Repository navigation

Issues

Agent restart programs pods from a partial policy set until every PolicyEndpoint is reconciled

Rules whose masked network address equals the node IP are dropped, so a ClusterNetworkPolicy Deny is not enforced on that node

Conntrack cleanup reads the whole kernel conntrack table into memory every cleanup period; agent memory scales with node table size

CNI ADD can return success while the pod's shared eBPF maps have no pod_state entries

Except lists are merged across rules that share a CIDR, so one rule's except removes another rule's ports

IPv4-mapped ipBlock CIDRs are canonicalized after the prefix-length sort, producing wrong port sets

podIdentifierToPolicyEndpointMap keeps a dead slice name for non-local identifiers after a multi-slice policy is deleted

Pod CNI ADD fails with "no active filter to detach" when another agent installs the clsact qdisc concurrently

Make ParentRef key available for every reconcile event

Add pod/namespace and port labels to network_policy_drop_count_total (and network_policy_drop_bytes_total)

deriveTargetPodsForParentNP continues with an empty PolicyEndpoint on non-NotFound Get errors

removeDuplicateL4Rules keys on *Protocol pointer address, so duplicate cluster policy L4 rules are never removed

Cluster policy rule processing grows exponentially when a CIDR repeats across rules

Standard mode: new pod's first egress packet dropped while policies attach under a namespace egress default-deny (v1.4.3)

Standard mode: start pods isolated when the namespace has a NetworkPolicy with an empty podSelector

Pod state map update fails with EINVAL after a partial BPF load is accepted as success

CronJob pods with names truncated to 63 chars share one podIdentifier across all runs; overlapping runs lose return traffic (ingress BPF_DROP) until the shared program is unpinned

Expose NetworkPolicy Attribution in Network Policy Agent Flow Logs

Allow configuring the Kubernetes API server endpoint to avoid kube-proxy startup dependency

Validate pinned BPF map schemas at startup

LoadBpfFile returns success with an incomplete map set; pod_state write then fails with EINVAL and the pod is isolated

Proposed node-agent orphan-GC

Recreated same-named Job pods inherit stale NetworkPolicy enforcement via podIdentifier after pod-template labels change to be exempt (standard mode)

Make flow-event log level configurable per verdict (ACCEPT / DENY)

Expose reconciliation metrics (Prometheus/CloudWatch)