AWS eks documentation change
Summary
Updated documentation for EKS hybrid nodes add-ons, including restructuring content, adding community add-ons section, and clarifying network requirements for various add-ons.
Security assessment
The changes primarily focus on restructuring content, adding new sections for community add-ons, and clarifying network configuration requirements. There is no evidence of addressing specific security vulnerabilities or adding new security features.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-add-ons.md index dfd378ce2..09c7d3387 100644 --- a/eks/latest/userguide/hybrid-nodes-add-ons.md +++ b/eks/latest/userguide/hybrid-nodes-add-ons.md @@ -5 +5 @@ -kube-proxy and CoreDNSCloudWatch Observability Agent add-onAmazon Managed Prometheus managed collector for hybrid nodesAWS Distro for OpenTelemetry (ADOT) add-onAWS Load Balancer ControllerEKS Pod Identity Agent add-onCSI snapshot controller add-on +AWS add-onskube-proxy and CoreDNSCloudWatch Observability agentAmazon Managed Prometheus managed collector for hybrid nodesAWS Distro for OpenTelemetry (ADOT)AWS Load Balancer ControllerEKS Pod Identity AgentCSI snapshot controllerCommunity add-onsKubernetes Metrics Server @@ -13 +13 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -This page describes considerations for running Amazon EKS add-ons from AWS on Amazon EKS Hybrid Nodes. To learn more about the Amazon EKS add-ons from AWS and the processes for creating, upgrading, and removing add-ons from your cluster, see [Amazon EKS add-ons](./eks-add-ons.html). The processes for creating, upgrading, and removing Amazon EKS add-ons is the same for Amazon EKS clusters with hybrid nodes as it is for Amazon EKS clusters with nodes running in AWS Cloud unless otherwise noted on this page. +This page describes considerations for running AWS add-ons and community add-ons on Amazon EKS Hybrid Nodes. To learn more about Amazon EKS add-ons and the processes for creating, upgrading, and removing add-ons from your cluster, see [Amazon EKS add-ons](./eks-add-ons.html). Unless otherwise noted on this page, the processes for creating, upgrading, and removing Amazon EKS add-ons is the same for Amazon EKS clusters with hybrid nodes as it is for Amazon EKS clusters with nodes running in AWS Cloud. Only the add-ons included on this page have been validated for compatibility with Amazon EKS Hybrid Nodes. @@ -15 +15 @@ This page describes considerations for running Amazon EKS add-ons from AWS on Am -The following Amazon EKS add-ons from AWS are compatible with Amazon EKS Hybrid Nodes. +The following AWS add-ons are compatible with Amazon EKS Hybrid Nodes. @@ -17 +17 @@ The following Amazon EKS add-ons from AWS are compatible with Amazon EKS Hybrid -EKS add-on | Compatible add-on versions +AWS add-on | Compatible add-on versions @@ -22 +22 @@ AWS Distro for OpenTelemetry (ADOT) | v0.102.1-eksbuild.2 and above -CloudWatch Observability Agent | v2.2.1-eksbuild.1 and above +CloudWatch Observability agent | v2.2.1-eksbuild.1 and above @@ -26 +26 @@ CSI snapshot controller | v8.1.0-eksbuild.1 and above -In addition to the Amazon EKS add-ons in the table above, the [Amazon Managed Service for Prometheus Collector](./prometheus.html), and the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) for [application ingress](./alb-ingress.html) (HTTP) and [load balancing](./network-load-balancing.html) (TCP/UDP) are compatible with hybrid nodes. +The following community add-ons are compatible with Amazon EKS Hybrid Nodes. To learn more about community add-ons, see [Community add-ons](./community-addons.html). @@ -28 +28,7 @@ In addition to the Amazon EKS add-ons in the table above, the [Amazon Managed Se -Amazon EKS add-ons from AWS that are not compatible with Amazon EKS Hybrid Nodes have been updated with an affinity rule for the default eks.amazonaws.com/compute-type: hybrid label applied to hybrid nodes. This prevents them from running on hybrid nodes when deployed in your clusters. If you have clusters with both hybrid nodes and nodes running in AWS Cloud, Amazon EKS add-ons that are not compatible with hybrid nodes can still be deployed in your cluster to nodes running in AWS Cloud. The Amazon VPC CNI is not compatible with hybrid nodes, and Cilium and Calico are supported as the Container Networking Interfaces (CNIs) for Amazon EKS Hybrid Nodes. See [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html) for more information. +Community add-on | Compatible add-on versions +---|--- +Kubernetes Metrics Server | v0.7.2-eksbuild.1 and above + +In addition to the Amazon EKS add-ons in the tables above, the [Amazon Managed Service for Prometheus Collector](./prometheus.html), and the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) for [application ingress](./alb-ingress.html) (HTTP) and [load balancing](./network-load-balancing.html) (TCP/UDP) are compatible with hybrid nodes. + +There are AWS add-ons and community add-ons that aren’t compatible with Amazon EKS Hybrid Nodes. The latest versions of these add-ons have an anti-affinity rule for the default `eks.amazonaws.com/compute-type: hybrid` label applied to hybrid nodes. This prevents them from running on hybrid nodes when deployed in your clusters. If you have clusters with both hybrid nodes and nodes running in AWS Cloud, you can deploy these add-ons in your cluster to nodes running in AWS Cloud. The Amazon VPC CNI is not compatible with hybrid nodes, and Cilium and Calico are supported as the Container Networking Interfaces (CNIs) for Amazon EKS Hybrid Nodes. See [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html) for more information. @@ -30 +36,3 @@ Amazon EKS add-ons from AWS that are not compatible with Amazon EKS Hybrid Nodes -The rest of this page describes differences between running compatible Amazon EKS add-ons from AWS on hybrid nodes, compared to the other Amazon EKS compute types. +## AWS add-ons + +The sections that follow describe differences between running compatible AWS add-ons on hybrid nodes compared to other Amazon EKS compute types. @@ -34 +42,3 @@ The rest of this page describes differences between running compatible Amazon EK -Kube-proxy and CoreDNS are installed as unmanaged add-ons by default when an EKS cluster is created. These add-ons can be managed as Amazon EKS add-ons after cluster creation. Reference the EKS documentation for details on [Manage kube-proxy in Amazon EKS clusters](./managing-kube-proxy.html) and [Manage CoreDNS for DNS in Amazon EKS clusters](./managing-coredns.html). If you are running a cluster with hybrid nodes and nodes in AWS Cloud, it is recommended to have at least one CoreDNS replica on hybrid nodes and at least one CoreDNS replica on your nodes in AWS Cloud. +EKS installs Kube-proxy and CoreDNS as self-managed add-ons by default when you create an EKS cluster with the AWS API and AWS SDKs, including from the AWS CLI. You can overwrite these add-ons as Amazon EKS add-ons after cluster creation. Reference the EKS documentation for details on [Manage kube-proxy in Amazon EKS clusters](./managing-kube-proxy.html) and [Manage CoreDNS for DNS in Amazon EKS clusters](./managing-coredns.html). If you are running a cluster with hybrid nodes and nodes in AWS Cloud, we recommend that you have at least one CoreDNS replica on hybrid nodes and at least one CoreDNS replica on your nodes in AWS Cloud. + +## CloudWatch Observability agent @@ -36 +46 @@ Kube-proxy and CoreDNS are installed as unmanaged add-ons by default when an EKS -## CloudWatch Observability Agent add-on +As the CloudWatch Observability agent runs [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/), you must configure a remote pod network when creating your Amazon EKS cluster, and you must make your pod IP addresses routable. Implementing Border Gateway Protocol (BGP) with the CNI is one common way to make your pod IP addresses routable. @@ -74 +84 @@ Follow the steps in [Using an AWS managed collector](https://docs.aws.amazon.com -## AWS Distro for OpenTelemetry (ADOT) add-on +## AWS Distro for OpenTelemetry (ADOT) @@ -76 +86 @@ Follow the steps in [Using an AWS managed collector](https://docs.aws.amazon.com -You can use the AWS Distro for OpenTelemetry (ADOT) Amazon EKS add-on to collect metrics, logs, and tracing data from your applications running on hybrid nodes. Note, ADOT uses admission [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/) to mutate and validate the Collector Custom Resource requests and you must configure your remote pod network when creating your Amazon EKS cluster. +You can use the AWS Distro for OpenTelemetry (ADOT) Amazon EKS add-on to collect metrics, logs, and tracing data from your applications running on hybrid nodes. ADOT uses admission [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/) to mutate and validate the Collector Custom Resource requests. For the EKS control plane to reach webhooks running on hybrid nodes, you must configure your remote pod network when creating your Amazon EKS cluster, and you must make your pod IP addresses routable. Implementing Border Gateway Protocol (BGP) with the CNI is one common way to make your pod IP addresses routable. @@ -82 +92 @@ Follow the steps in [Getting Started with AWS Distro for OpenTelemetry using EKS -You can use the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type ip for workloads on hybrid nodes connected with AWS Direct Connect or AWS Site-to-Site VPN. As the AWS Load Balancer Controller uses [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/), you must configure your remote pod network when creating your Amazon EKS cluster. +You can use the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type ip for workloads on hybrid nodes connected with AWS Direct Connect or AWS Site-to-Site VPN. As the AWS Load Balancer Controller uses [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/), you must configure a remote pod network when creating your Amazon EKS cluster, and you must make your pod IP addresses routable. Implementing Border Gateway Protocol (BGP) with the CNI is one common way to make your pod IP addresses routable. @@ -97 +107 @@ For load balancing with NLB, you must specify the annotations below. See [Route -## EKS Pod Identity Agent add-on +## EKS Pod Identity Agent @@ -131 +141 @@ This will configure `nodeadm` to create a credentials file to be configured on t -## CSI snapshot controller add-on +## CSI snapshot controller @@ -134,0 +145,8 @@ Starting with version `v8.1.0-eksbuild.2`, the [CSI snapshot controller add-on]( +## Community add-ons + +The sections that follow describe differences between running compatible community add-ons on hybrid nodes compared to other Amazon EKS compute types. + +## Kubernetes Metrics Server + +The control plane needs to reach Metrics Server’s pod IP (or node IP if hostNetwork is enabled). Therefore, unless you run Metrics Server in hostNetwork mode, you must configure a remote pod network when creating your Amazon EKS cluster, and you must make your pod IP addresses routable. Implementing Border Gateway Protocol (BGP) with the CNI is one common way to make your pod IP addresses routable. +