OS Manuals

/usr/bin/controller

Amazon EKS Network Policy Agent is a daemonset that is responsible for enforcing configured network policies on the cluster.

From aws-network-policy-agent-fips 1.4.3-r7 (enterprise-packages), captured 2026-11-09 by running controller --help (exit 0). permalink

2026-11-09 14:32:09.354058663 +0000 UTC m=+0.041990034 write error: can't make directories for new logfile: mkdir /var/log/aws-routed-eni: read-only file system
2026-11-09 14:32:09.354229933 +0000 UTC m=+0.042161304 write error: can't make directories for new logfile: mkdir /var/log/aws-routed-eni: read-only file system
2026-11-09 14:32:09.354298863 +0000 UTC m=+0.042230234 write error: can't make directories for new logfile: mkdir /var/log/aws-routed-eni: read-only file system
2026-11-09 14:32:09.354358223 +0000 UTC m=+0.042289594 write error: can't make directories for new logfile: mkdir /host: read-only file system
2026-11-09 14:32:09.354407953 +0000 UTC m=+0.042339324 write error: can't make directories for new logfile: mkdir /host: read-only file system
Usage of :
      --conntrack-cache-cleanup-period int   Cleanup interval for network policy agent conntrack cache (default 300)
      --conntrack-cache-table-size int       Table size for network policy agent conntrack cache (default 524288)
      --enable-cloudwatch-logs               If enabled, policy decision logs will be streamed to CloudWatch, requires "enable-policy-event-logs=true"
      --enable-ipv6                          If enabled, Network Policy agent will operate in IPv6 mode
      --enable-network-policy                If enabled, Network Policy agent will initialize BPF maps and start reconciler
      --enable-policy-event-logs             If enabled, policy decision logs will be collected & logged
      --enable-profiling                     If enabled, Network Policy agent will enable profiling
      --health-probe-bind-addr string        The address the health probes binds to. (default ":8163")
      --kubeconfig string                    Path to the kubeconfig file containing authorization and API server information.
      --log-file string                      Set the controller log file - if not specified logs are written to stdout (default "/var/log/aws-routed-eni/network-policy-agent.log")
      --log-file-max-backups int             Set the controller maximum number of rotated log files to retain (default 8)
      --log-file-max-size int                Set the controller log file max size in megabytes before it gets rotated (default 200)
      --log-level string                     Set the controller log level - info, debug (default "debug")
      --max-concurrent-reconciles int        Maximum number of concurrent reconcile loops (default 3)
      --metrics-bind-addr string             The address the metric endpoint binds to. (default ":8162")
Options (15)
OptionDescriptionSource
--conntrack-cache-cleanup-period intCleanup interval for network policy agent conntrack cache (default 300)help
--conntrack-cache-table-size intTable size for network policy agent conntrack cache (default 524288)help
--enable-cloudwatch-logsIf enabled, policy decision logs will be streamed to CloudWatch, requires "enable-policy-event-logs=true"help
--enable-ipv6If enabled, Network Policy agent will operate in IPv6 modehelp
--enable-network-policyIf enabled, Network Policy agent will initialize BPF maps and start reconcilerhelp
--enable-policy-event-logsIf enabled, policy decision logs will be collected & loggedhelp
--enable-profilingIf enabled, Network Policy agent will enable profilinghelp
--health-probe-bind-addr stringThe address the health probes binds to.help
--kubeconfig stringPath to the kubeconfig file containing authorization and API server information.help
--log-file stringSet the controller log file - if not specified logs are written to stdout (default "/var/log/aws-routed-eni/network-policy-agent.log")help
--log-file-max-backups intSet the controller maximum number of rotated log files to retain (default 8)help
--log-file-max-size intSet the controller log file max size in megabytes before it gets rotated (default 200)help
--log-level stringSet the controller log level - info, debug (default "debug")help
--max-concurrent-reconciles intMaximum number of concurrent reconcile loops (default 3)help
--metrics-bind-addr stringThe address the metric endpoint binds to.help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.