Following are the prerequisites to deploy Firewall Threat Defense container in an Amazon EKS environment:

• Operating System: Ubuntu, Version - 20.04 LTS (minimum), 22.04 LTS (maximum)

• Kubernetes Environment:

  • Amazon EKS cluster version - 1.35

  • Managed or self-managed node group with at least one worker node.

  • Multus CNI installed for multi-network support.

• Kubernetes CNI

  • POD management CNI - AWS VPC CNI

  • FTDc data network CNI - Multus macvlan (passthru mode)

• Worker Node Requirements:

  • Hugepages configured (2Mi pages)

  • Use SSD/NVMe storage. HDD-based storage is not supported.

  • Data ENIs attached to data subnets.

  • Data ENIs tagged: node.k8s.amazonaws.com/no_manage=true.

  • Source/Destination check disabled on all data ENIs.

  • Worker node labeled with a custom label (for example, ftdc-node=worker1).

EKS Cluster Setup (one-time)

1. Multus CNI must be installed on the EKS cluster:

   kubectl apply -f https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/master/deployments/multus-daemonset-thick.yml

2. Tune VPC CNI to prevent it from managing data ENIs and pin a stable pod management IP address:

   kubectl set env daemonset aws-node -n kube-system \
     WARM_ENI_TARGET=0 \
     WARM_IP_TARGET=1 \
     MINIMUM_IP_TARGET=1

3. Pin a stable management IP address for the FTDc pod: By default, VPC CNI assigns a random secondary IP address from the primary ENI's subnet on each pod restart. To ensure the pod always gets the same management IP address:

   1. Remove all existing secondary IP addresses from the primary ENI:

      aws ec2 unassign-private-ip-addresses --network-interface-id <primary-eni-id> \
        --private-ip-addresses <ip1> <ip2> ...

   2. Assign a single specific IP address (for example, 10.0.1.10):

      aws ec2 assign-private-ip-addresses --network-interface-id <primary-eni-id> \
        --private-ip-addresses 10.0.1.10

   Since 10.0.1.10 is the only secondary IP address in the pool, VPC CNI will always assign it to the pod. The IP address stays on the ENI across pod restarts — VPC CNI only manages the pod-to-IP address mapping, not the ENI-level assignment.

   Note	On node replacement, the new node has a different primary ENI. You must re-assign 10.0.1.10 on the new ENI.

4. Label the worker nodes:

   kubectl label node <node-name> ftdc-node=worker1

AWS Infrastructure Requirements

1. Create the EKS node group in the management subnet (10.0.1.x) so the primary ENI is in the mgmt network.

2. Attach data ENIs from other subnets (must be same AZ as the node):

   aws ec2 attach-network-interface --instance-id <instance-id> \
     --network-interface-id <eni-id> --device-index <index>

3. Tag data ENIs with no_manage to prevent VPC CNI from allocating secondary IP addresses or detaching them:

   aws ec2 create-tags --resources <eni-inside> <eni-diag> <eni-outside> \
     --tags Key=node.k8s.amazonaws.com/no_manage,Value=true

   Without this tag, VPC CNI will treat data ENIs as its own warm ENIs and may detach or delete them during pod lifecycle events.

4. Disable Source/Destination check on data ENIs (required for FTDc to route/inspect traffic):

   aws ec2 modify-network-interface-attribute --network-interface-id <eni-id> \
     --no-source-dest-check

   This must be done for each data ENI. Without this, AWS will drop any traffic where the source or destination IP address does not match the ENI's assigned IP address.

5. Assign secondary IP addresses on data ENIs for FTDc pod data interfaces:

   FTDc data interfaces (configured via DHCP or statically inside FTDc) need IP addresses that are registered on the corresponding ENI to be VPC-routable. Assign a secondary IP address to each data ENI:

   
   aws ec2 assign-private-ip-addresses --network-interface-id <eni-diag-id>    --private-ip-addresses 10.0.2.10
   aws ec2 assign-private-ip-addresses --network-interface-id <eni-inside-id>  --private-ip-addresses 10.0.3.10
   aws ec2 assign-private-ip-addresses --network-interface-id <eni-outside-id> --private-ip-addresses 10.0.4.10

   • DHCP from inside the pod will assign the ENI's primary IP address (for example, 10.0.2.101)

   • To use a specific IP address (for example, x.x.x.10), configure it statically inside FTDc — AWS DHCP only hands out the primary IP address

   • Any IP address not registered on the ENI will be silently dropped by the VPC router

6. ECR access must be configured via IAM instance profile or node role.

Additional Requirements

• Helm: Version 3.8 or later for deploying FTDc using Helm charts (YAML-based Infrastructure-as-Code)

• Firewall Threat Defense Container (FTDc) image available in an accessible registry

• Management Center accessible from the cluster

Verify deployment status:

• Check all resources.

  kubectl get all -l app=FTDC

• Check pods.

  kubectl get pods -o wide

• Check service.

  kubectl get svc

• Check persistent volumes.

  kubectl get pv,pvc

• Check NetworkAttachmentDefinitions (for macvlan).

  kubectl get net-attach-def

• Check pod logs.

  kubectl logs -f <ftdc-pod-name>

• Check lina process (readiness probe).

  kubectl exec -it <ftdc-pod-name> -- pgrep -x lina

• Check readiness file.

  kubectl exec -it <ftdc-pod-name> -- cat /tmp/lina_ready

• Access FTDc CLI.

  kubectl exec -it <ftdc-pod-name> -- /bin/bash