Trying out Amazon CloudWatch Network Flow Monitor in EKS

1. Introduction

The Amazon CloudWatch Network Flow Monitor service, released in December 2024, provides visibility into communication patterns within AWS resources. This article details a test deployment within an EKS cluster, verifying setup and usability of the agent as a DaemonSet.

Why This Matters

Traditional network monitoring often relies on complex configurations and can struggle to pinpoint issues in dynamic containerized environments. CloudWatch Network Flow Monitor aims to address this by offering a managed service for traffic analysis, reducing the operational overhead of maintaining custom monitoring solutions. Without tools like this, diagnosing network performance bottlenecks or security issues can be time-consuming and costly, potentially leading to application downtime and degraded user experience.

Key Insights

• EKS Add-on Availability: Network Flow Monitor is available as an add-on for EKS clusters, simplifying deployment.
• Traffic Visibility: The service provides metrics on communication flows, including retransmissions, which can indicate network issues.
• DaemonSet Architecture: The agent runs as a DaemonSet, ensuring comprehensive coverage across all nodes in the cluster.

Working Example

kind: Deployment
metadata:
name: mynginx-with-tc-deployment
spec:
replicas: 2
selector:
matchLabels:
app: mynginx-with-tc
template:
metadata:
labels:
app: mynginx-with-tc
spec:
containers:
- name: mynginx-with-tc-container
image: xxxxxxxxxxxx.dkr.ecr.ap-northeast-3.amazonaws.com/mksamba/mynginx-with-tc-repo:latest
ports:
- containerPort: 80
securityContext:
capabilities:
add: ["NET_ADMIN"]
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app
operator: In
values:
- mynginx-with-tc
topologyKey: "kubernetes.io/hostname"

This deployment demonstrates deploying Nginx with the necessary NET_ADMIN capability to manipulate network traffic for testing purposes.

Practical Applications

• E-commerce Platform: Monitor traffic between microservices to identify latency issues impacting order processing.
• Pitfall: Relying solely on endpoint-based monitoring without visibility into inter-service communication can mask network-related performance problems.

References:

• https://dev.to/aws-builders/trying-out-amazon-cloudwatch-network-flow-monitor-in-eks-7pc