Skip to content

no proper filtering in aws/cloud enviroment for vpc/subnets etc... #41392

@liyihuang

Description

@liyihuang

https://github.com/cilium/cilium/blob/main/pkg/aws/eni/instances.go#L202-L222

we shouldn't need to list all VPC subnets resources since the EKS cluster can only sit in one VPC and we shouldn't care other VPC's resources(subnets/routes).

the operator should be able to figure out its own VPC and filter it based on its VPC, then it will reduces overall cpu/memory pressure for operator and prevent throttling from cloud.

In my test environment, I can see it can see all my VPC(numVPC=2), and I only have 2 VPCs.

This could also be problematic when users have a lot of resources in their account but not in related VPC but we shouldn't care(like too many subnets/SG causing ec2 to timeout etc).

time="2025-08-26T21:20:22.938032101Z" level=info msg="Synchronized ENI information" numInstances=3 numSecurityGroups=6 numSubnets=9 numVPCs=2 subsys=eni

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/eniImpacts ENI based IPAM.area/operatorImpacts the cilium-operator component

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions