Create Network FLow Monitor Addon #1212

zjaco13 · 2025-11-14T00:01:02Z

Issue #, if available:
#1208
Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

zjaco13 · 2025-12-31T23:42:50Z

@shapirov103 @elamaran11 functionally validated, had to make a bunch of changes to core addon and pod identity to make it work so please review!

shapirov103

Looks great, a couple of minor comments/questions. Pending functional validation.

shapirov103 · 2026-01-02T15:51:37Z

lib/addons/aws-network-flow-monitor/index.ts

+}
+
+/* VersioMap showing the default version for supported Kubernetes versions */
+const versionMap: Map<KubernetesVersion, string> = new Map([


why no entry for 1.34? I see it in the matrix aws eks describe-addon-versions --addon-name aws-network-flow-monitoring-agent

shapirov103 · 2026-01-02T16:09:41Z

lib/addons/eks-pod-identity-agent/index.ts

 */
 export class EksPodIdentityAgentAddOn extends CoreAddOn {

    @utils.conflictsWithAutoMode(utils.AutoModeConflictType.VERSION_MISMATCH, 'v1.3.4-eksbuild.1')


when running aws eks describe-addon-versions i see the following output:

- addonVersion: v1.0.2-eksbuild.6 architecture: - amd64 - arm64 compatibilities: - clusterVersion: '1.34' defaultVersion: false platformVersions: - '*' - ... computeTypes: - ec2 - auto requiresConfiguration: false requiresIamPermissions: true

we could incorporate these compute types and amd/arm support into the addon validation, e.g. auto mode compatibility for automode cluster provider and such.

It is not something to address in this PR, just a note to keep in mind.

shapirov103

minor comment

shapirov103 · 2026-01-02T19:26:58Z

lib/utils/object-utils.ts

 import { KubernetesVersion } from "aws-cdk-lib/aws-eks";
 import { cloneDeepWith } from 'lodash';
 import * as nutil from 'node:util/types';
+import { ManagedPolicyReference } from "aws-cdk-lib/aws-iam";


it is from my commit iirc, let's remove this unused import, let's run make lint on the project

shapirov103

LGTM
functional validation complete

❯ kubectl get pods -n amazon-network-flow-monitor
NAME                                   READY   STATUS    RESTARTS   AGE
aws-network-flow-monitor-agent-mfr86   1/1     Running   0          13m

╰─❯

zjaco13 · 2026-01-02T20:27:11Z

LGTM functional validation complete

❯ kubectl get pods -n amazon-network-flow-monitor
NAME                                   READY   STATUS    RESTARTS   AGE
aws-network-flow-monitor-agent-mfr86   1/1     Running   0          13m

╰─❯

@shapirov103 check logs if you can to make sure pod identity is working correctly. If not you'll see errors about OIDC stuff (before fixes to core-addon)

shapirov103 · 2026-01-02T20:36:05Z

LGTM functional validation complete
❯ kubectl get pods -n amazon-network-flow-monitor
NAME                                   READY   STATUS    RESTARTS   AGE
aws-network-flow-monitor-agent-mfr86   1/1     Running   0          13m

╰─❯ 
@shapirov103 check logs if you can to make sure pod identity is working correctly. If not you'll see errors about OIDC stuff (before fixes to core-addon)

@zjaco13 I don't see any errors in the log, all INFO messages. However, i do observe something odd:

$ aws eks list-pod-identity-associations --cluster-name blueprint-construct-dev

associations:
- associationArn: arn:aws:eks:us-east-2:929819487611:podidentityassociation/blueprint-construct-dev/a-gcmtm4vtnujtkv5od
  associationId: a-gcmtm4vtnujtkv5od
  clusterName: blueprint-construct-dev
  namespace: amazon-network-flow-monitor
  ownerArn: arn:aws:eks:us-east-2:929819487611:addon/blueprint-construct-dev/aws-network-flow-monitoring-agent/02cdc025-6a17-bb70-bf61-32acc4da46fe
  serviceAccount: aws-network-flow-monitor-agent-service-account
- associationArn: arn:aws:eks:us-east-2:929819487611:podidentityassociation/blueprint-construct-dev/a-qapuueff8twne5lwj
  associationId: a-qapuueff8twne5lwj
  clusterName: blueprint-construct-dev
  namespace: kube-system
  serviceAccount: aws-network-flow-monitor-agent-service-account

Why are there two associations, one is in kube-system?

shapirov103 · 2026-01-08T15:35:47Z

I had a failure on cluster delete, could be unrelated(subnet dependency), have you tried creating and dropping the stack?

elamaran11

@zjaco13 Nice work. Can you test with Graviton Nodes too?
Following needs to be added to ADOT Addon to scraper config to scrape the NFM Metrics.

  - job_name: 'eks-nfm-agent'
    kubernetes_sd_configs:
    - role: pod
    metrics_path: /metrics
    relabel_configs:
    - source_labels:
      - __meta_kubernetes_namespace
      - __meta_kubernetes_pod_label_name
      action: keep
      regex: amazon-network-flow-monitor;aws-network-flow-monitor-agent
    - target_label: __address__
      replacement: ${1}:9101
      source_labels:
      - __meta_kubernetes_pod_ip

elamaran11 · 2026-01-08T16:07:20Z

lib/addons/aws-network-flow-monitor/index.ts

+/**
+ * Implementation of Network Flow Monitor Agent addon for EKS
+ */
+@utils.supportsALL


Did you test with Graviton Nodes?

yes, tested on graviton!

zjaco13 · 2026-01-12T18:57:54Z

@zjaco13 Nice work. Can you test with Graviton Nodes too? Following needs to be added to ADOT Addon to scraper config to scrape the NFM Metrics.

  - job_name: 'eks-nfm-agent'
    kubernetes_sd_configs:
    - role: pod
    metrics_path: /metrics
    relabel_configs:
    - source_labels:
      - __meta_kubernetes_namespace
      - __meta_kubernetes_pod_label_name
      action: keep
      regex: amazon-network-flow-monitor;aws-network-flow-monitor-agent
    - target_label: __address__
      replacement: ${1}:9101
      source_labels:
      - __meta_kubernetes_pod_ip

@elamaran11 Added to AMP addon

zjaco13 · 2026-01-12T18:58:49Z

I had a failure on cluster delete, could be unrelated(subnet dependency), have you tried creating and dropping the stack?

Believe unrelated, have had no issues with test stack

zjaco13 marked this pull request as ready for review November 14, 2025 23:45

zjaco13 requested review from elamaran11 and shapirov103 as code owners November 14, 2025 23:45

zjaco13 added 6 commits December 18, 2025 16:59

start nfm addon work

9eda5ec

fix link

77a24df

upgrade nfm version

d69bc43

add variable support

8156caa

add nfm to e2e

554522f

move to after pod identity

5802945

zjaco13 force-pushed the feat/nfm-addon branch from 3f51c74 to 5802945 Compare December 19, 2025 01:00

zjaco13 added 4 commits December 18, 2025 17:01

add nfm tester

47cb2c9

finish docs and fix eks podidentity

7e0473b

setup podidentity support for coreaddons

8d53a4c

fix lint

1bf4a53

shapirov103 reviewed Jan 2, 2026

View reviewed changes

zjaco13 added 4 commits January 2, 2026 10:19

fix version map

3654011

fix build for 1.34

76728ae

update other versions and fix link

0f3cc66

fix calico links

5b29b35

shapirov103 reviewed Jan 2, 2026

View reviewed changes

fix lint

ae1d315

shapirov103 previously approved these changes Jan 2, 2026

View reviewed changes

update create service account functions to support pod-identity

4d9b46d

zjaco13 dismissed shapirov103’s stale review via 4d9b46d January 2, 2026 22:51

elamaran11 reviewed Jan 8, 2026

View reviewed changes

add amp to testing

4a2878a

zjaco13 changed the title ~~start nfm addon work~~ Create Network FLow Monitor Addon Jan 12, 2026

Create Network FLow Monitor Addon #1212

Are you sure you want to change the base?

Create Network FLow Monitor Addon #1212

Uh oh!

Conversation

zjaco13 commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zjaco13 commented Dec 31, 2025

Uh oh!

shapirov103 left a comment

Choose a reason for hiding this comment

Uh oh!

shapirov103 Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

zjaco13 Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

shapirov103 Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

shapirov103 left a comment

Choose a reason for hiding this comment

Uh oh!

shapirov103 Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

zjaco13 Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

shapirov103 left a comment

Choose a reason for hiding this comment

Uh oh!

zjaco13 commented Jan 2, 2026

Uh oh!

shapirov103 commented Jan 2, 2026

Uh oh!

shapirov103 commented Jan 8, 2026

Uh oh!

elamaran11 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elamaran11 Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

zjaco13 Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

zjaco13 commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zjaco13 commented Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zjaco13 commented Nov 14, 2025 •

edited

Loading

elamaran11 left a comment •

edited

Loading

zjaco13 commented Jan 12, 2026 •

edited

Loading