How it works
A Pod gets a dedicated branch network interface one of two ways:
SecurityGroupPolicy (recommended) — You create a SecurityGroupPolicy that selects Pods by label (podSelector), service account (serviceAccountSelector), or both, and references one or more security groups. The admission webhook then injects a resource claim into any new Pod matched by the policy, with no changes needed to the Pod spec itself.
Native Dynamic Resource Allocation (DRA) — You add a resourceClaims entry to the Pod spec that points at the ResourceClaimTemplate the controller generates for an existing SecurityGroupPolicy, bypassing the webhook’s podSelector or serviceAccountSelector matching and automatic injection. The SecurityGroupPolicy is still what resolves and supplies the security groups; this path only changes how a Pod gets associated with it. See Alternative: reference the controller-generated claim template with native DRA.
From there, both paths converge:
The Kubernetes scheduler allocates a device representing a branch-interface slot on a node, backed by the resolved security groups.
EKS Auto Mode creates and attaches a branch network interface carrying those security groups, and the Pod’s networking is configured through it.
Pods with no resource claim, by either path, are unaffected and continue to use the node’s own security groups, as with any other EKS Auto Mode Pod.
Top comments (0)