AWS SDN connector EKS filtering support

The AWS SDN connector now supports filtering of EKS clusters. If the allow-list contains at least one entry, only clusters explicitly included in the allow-list will be resolved by the AWS SDN connector. Clusters not in the allow-list will be excluded from dynamic address object resolution. As a result, AWS resource resolution performance is improved.

EKS filter configuration

The EKS allowlist field is available when creating or editing an AWS SDN connector. The field supports listing multiple EKS/Kubernetes cluster names.

After an allow-list is configured, the AWS SDN connector will resolve only the specified EKS/Kubernetes clusters.

CLI configuration example

config system sdn-connector
    edit "awssdn1"
        set status enable
        set type aws
        set use-metadata-iam enable
        set update-interval 30
        set k8s-allow-list "exciting-metal-ladybug"
    next
end

Verifying the EKS filtering

Run debug commands to verify EKS allowlist filters on your desired clusters:

# diagnose debug reset
# diagnose debug application awsd -1
# diagnose debug enable

…
2026-04-13 16:07:21 EKS cluster adorable-country-outfit is skipped by k8s allowlist.
2026-04-13 16:07:21 awsd getting IPs from EKS cluster: exciting-metal-ladybug (us-east-1), endpoint: https://62C90#############4FC4CC9FA8.gr7.us-east1.eks.amazonaws.com
…

2026-04-13 16:07:51 EKS cluster adorable-country-outfit is skipped by k8s allowlist.
2026-04-13 16:07:51 awsd getting IPs from EKS cluster: exciting-metal-ladybug (us-east-1), endpoint: https://62C90#############4FC4CC9FA8.gr7.us-east1.eks.amazonaws.com
2026-04-13 16:07:51 kube host: 62C90#############4FC4CC9FA8.gr7.us-east-1.eks.amazonaws.com:443:10.0.1.115
2026-04-13 16:07:51 k8s service ip: 172.20.0.1, svcname: kubernetes, namespace: default
2026-04-13 16:07:51 k8s service ip: 172.20.81.114, svcname: eks-extension-metrics-api, namespace: kube-system
2026-04-13 16:07:51 k8s service ip: 172.20.116.198, svcname: metrics-server, namespace: kube-system
2026-04-13 16:07:51 kube host: 62C90#############4FC4CC9FA8.gr7.us-east-1.eks.amazonaws.com:443:10.0.1.115
2026-04-13 16:07:51 k8s node ip: 10.0.1.215, nodename: i-0b27e094dc6ee09e1, zone: us-east-1a
2026-04-13 16:07:51 k8s node ip: 98.XXX.XXX.XX, nodename: i-0b27e094dc6ee09e1, zone: us-east-1a
2026-04-13 16:07:51 k8s node ip: 10.0.11.224, nodename: i-0b6403fce57f51e77, zone: us-east-1b
2026-04-13 16:07:51 k8s node ip: 98.89.27.30, nodename: i-0b6403fce57f51e77, zone: us-east-1b
2026-04-13 16:07:51 kube host: 62C90#############4FC4CC9FA8.gr7.us-east-1.eks.amazonaws.com:443:10.0.1.115
2026-04-13 16:07:51 k8s pod ip: 10.0.11.176, podname: metrics-server-#########-sbdzd, namespace: kube-system, zone: us-east-1b
2026-04-13 16:07:51 k8s pod ip: 10.0.11.176, podname: metrics-server-#########-sbdzd, namespace: kube-system, zone: us-east-1b
2026-04-13 16:07:51 k8s pod ip: 10.0.1.6, podname: metrics-server-#########-z8q7j, namespace: kube-system, zone: us-east-1a
2026-04-13 16:07:51 k8s pod ip: 10.0.1.6, podname: metrics-server-#########-z8q7j, namespace: kube-system, zone: us-east-1a
2026-04-13 16:07:51 awsd sdn connector awssdn1 start updating IP addresses
2026-04-13 16:07:51 awsd checking firewall address object awsaddr1, vd 0
2026-04-13 16:07:51 awsd checking firewall address object awsaddr2, vd 0
2026-04-13 16:07:51 awsd sdn connector awssdn1 finish updating IP addresses 2026-04-13 16:07:51 awsd reap child pid: 3974