Back to Checks
alibabacloud

Kubernetes cluster has ENI multiple IP mode enabled

cs_kubernetes_eni_multiple_ip_enabled
Service: csSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

With ENI multiple IP mode provided by the Terway network plugin, Kubernetes Engine clusters allocate pod IPs from the VPC CIDR block, enabling better scalability and native integration with Alibaba Cloud services. This mode allows pods to have their own security group associations, providing granular network-level access control independently from host nodes.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without ENI multiple IP mode (Terway plugin), pods share the node's network interface and cannot have independent security group associations. This limits granular firewall controls at the pod level, increasing lateral movement risk if a pod is compromised. The inability to isolate pod from node networking weakens network segmentation and the cluster's security posture.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_eni_multiple_ip_enabled

Recommendation

Select the Terway network plugin during cluster creation to enable ENI multiple IP mode. Existing clusters using Flannel cannot be migrated to Terway and must be recreated.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id> --header 'Content-Type=application/json' | jq '.parameters.Network'

Other

1When creating a new cluster in the **ACK Console**, select **Terway** in the `Network Plugin` option to enable ENI multiple IP mode support.
2Note that existing clusters using **Flannel** cannot be migrated to **Terway**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_eni_multiple_ip_enabled(Check):
    """Check if ENI multiple IP mode is supported on Kubernetes Engine Clusters."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.eni_multiple_ip_enabled:
                report.status = "PASS"
                report.status_extended = f"Kubernetes cluster {cluster.name} supports ENI multiple IP mode via Terway plugin."
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} does not support ENI multiple IP mode (requires Terway network plugin)."

            findings.append(report)

        return findings

References