Automating proxy injection using Kyverno on Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate addresses a recurring source of friction for enterprises that run Amazon EKS in regulated environments. These organizations route all outbound traffic through a corporate HTTP/HTTPS proxy to meet egress security and compliance requirements. When they adopt Amazon EKS on AWS Fargate, they hit a wall. AWS manages Fargate nodes, which offer no surface for customers to apply node-level proxy configuration. Without proxy settings, Fargate pods may be unable to reach external endpoints.
This can prevent traffic from following required egress controls and may affect third-party API calls. This challenge is not unique to Fargate. Even on Amazon Elastic Compute Cloud (Amazon EC2) based nodes, node-level proxy configuration typically covers only host processes such as the kubelet and image pulls. User data scripts and /etc/environment are examples of this node-level configuration. Containers run in isolated environments and don’t inherit node-level environment variables. As a result, pod-level proxy injection requires an admission-time solution regardless of compute type.
Fargate makes the gap unavoidable because the node layer is not exposed for customer configuration. In this post, we demonstrate how to use Kyverno mutating admission policies to inject proxy environment variables into Fargate pods in labeled namespaces automatically. No proxy-related changes to application deployment manifests are required. A cluster operations team configures one policy, and workloads in the labeled namespaces inherit the correct proxy settings automatically. The solution has three building blocks that work together to inject proxy settings at pod admission time.
A Fargate profile maps one or more namespaces to Fargate compute. Because the node layer isn’t exposed for customer configuration, proxy settings must be present in the pod specification before the pod is scheduled. Kyverno is a Cloud Native Computing Foundation (CNCF) graduated policy engine for Kubernetes that runs as a mutating and validating admission webhook. Its policies are native Kubernetes YAML, deployed through the Helm chart and any GitOps pipeline. For this solution, Kyverno hosts a MutatingPolicy that rewrites incoming pod specifications.