AWS eks documentation change
Summary
Updated log collection documentation: Renamed 'CNI log collection tool' to 'EKS Log Collector', changed script path/version, added Bottlerocket log reference, updated download URL and output examples
Security assessment
Changes focus on log collection tool renaming, path updates, and version improvements without mentioning security vulnerabilities or security-specific enhancements. The Bottlerocket log addition is documentation expansion, not security-related.
Diff
diff --git a/eks/latest/userguide/troubleshooting.md b/eks/latest/userguide/troubleshooting.md index b16628cfb..f438beef5 100644 --- a/eks/latest/userguide/troubleshooting.md +++ b/eks/latest/userguide/troubleshooting.md @@ -5 +5 @@ -Insufficient capacityNodes fail to join clusterUnauthorized or access denied (kubectl)hostname doesn’t matchgetsockopt: no route to hostInstances failed to join the Kubernetes clusterManaged node group error codesNot authorized for imagesNode is in NotReady stateCNI log collection toolContainer runtime network not readyTLS handshake timeoutInvalidClientTokenIdNode groups must match Kubernetes version before upgrading control planeWhen launching many nodes, there are Too Many Requests errorsHTTP 401 unauthorized error response on Kubernetes API server requestsAmazon EKS platform version is more than two versions behind the current platform versionCluster health FAQs and error codes with resolution paths +Insufficient capacityNodes fail to join clusterUnauthorized or access denied (kubectl)hostname doesn’t matchgetsockopt: no route to hostInstances failed to join the Kubernetes clusterManaged node group error codesNot authorized for imagesNode is in NotReady stateEKS Log CollectorContainer runtime network not readyTLS handshake timeoutInvalidClientTokenIdNode groups must match Kubernetes version before upgrading control planeWhen launching many nodes, there are Too Many Requests errorsHTTP 401 unauthorized error response on Kubernetes API server requestsAmazon EKS platform version is more than two versions behind the current platform versionCluster health FAQs and error codes with resolution paths @@ -311 +311 @@ For Amazon EKS optimized Windows AMIs, there’s no reservation for compute reso -## CNI log collection tool +## EKS Log Collector @@ -313 +313 @@ For Amazon EKS optimized Windows AMIs, there’s no reservation for compute reso -The Amazon VPC CNI plugin for Kubernetes has its own troubleshooting script that is available on nodes at `/opt/cni/bin/aws-cni-support.sh`. You can use the script to collect diagnostic logs for support cases and general troubleshooting. +To troubleshoot issue with Amazon EKS nodes, there is a pre-built script available on nodes located at `/etc/eks/log-collector-script/eks-log-collector.sh`. You can use the script to collect diagnostic logs for support cases and general troubleshooting. @@ -318 +318 @@ Use the following command to run the script on your node: - sudo bash /opt/cni/bin/aws-cni-support.sh + sudo bash /etc/eks/log-collector-script/eks-log-collector.sh @@ -322 +322 @@ Use the following command to run the script on your node: -If the script is not present at that location, then the CNI container failed to run. You can manually download and run the script with the following command: +If the script is not present at that location. You can manually download and run the script with the following command: @@ -325 +325 @@ If the script is not present at that location, then the CNI container failed to - curl -O https://raw.githubusercontent.com/awslabs/amazon-eks-ami/master/log-collector-script/linux/eks-log-collector.sh + curl -O https://amazon-eks.s3.amazonaws.com/support/log-collector-script/linux/eks-log-collector.sh @@ -328 +328 @@ If the script is not present at that location, then the CNI container failed to -The script collects the following diagnostic information. The CNI version that you have deployed can be earlier than the script version. +The script collects the following diagnostic information. @@ -331 +331,3 @@ The script collects the following diagnostic information. The CNI version that y - This is version 0.6.1. New versions can be found at https://github.com/awslabs/amazon-eks-ami + $ sudo bash /etc/eks/log-collector-script/eks-log-collector.sh + + This is version 0.7.8. New versions can be found at https://github.com/awslabs/amazon-eks-ami/blob/main/log-collector-script/ @@ -336,15 +338,4 @@ The script collects the following diagnostic information. The CNI version that y - Trying to collect SELinux status... - Trying to collect iptables information... - Trying to collect installed packages... - Trying to collect active system services... - Trying to collect Docker daemon information... - Trying to collect kubelet information... - Trying to collect L-IPAMD information... - Trying to collect sysctls information... - Trying to collect networking information... - Trying to collect CNI configuration information... - Trying to collect running Docker containers and gather container data... - Trying to collect Docker daemon logs... - Trying to archive gathered information... - - Done... your bundled logs are located in /var/log/eks_i-0717c9d54b6cfaa19_2020-03-24_0103-UTC_0.6.1.tar.gz + ... + ... + + Done... your bundled logs are located in /var/log/eks_i-EXAMPLE_2025-03-25_0000-UTC_0.7.8.tar.gz @@ -355 +346,3 @@ The diagnostic information is collected and stored at: - /var/log/eks_i-0717c9d54b6cfaa19_2020-03-24_0103-UTC_0.6.1.tar.gz + /var/log/eks_i-EXAMPLE_2025-03-25_0000-UTC_0.7.8.tar.gz + +To retrieve log bundle for Bottlerocket nodes, please refer to [Bottlerocket Log](https://github.com/bottlerocket-os/bottlerocket?tab=readme-ov-file#logs) for more details.