AWS eks documentation change
Summary
Updated documentation for EKS hybrid nodes configuration, including network requirements, authentication modes, endpoint access recommendations, and add-on compatibility instructions
Security assessment
Changes emphasize security best practices like requiring specific authentication modes (API/API_AND_CONFIG_MAP) and endpoint access configurations, but do not address a specific disclosed vulnerability or security incident. The CIDR validation and network isolation requirements improve security posture but are preventative measures rather than fixes.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-cluster-update.md b/eks/latest/userguide/hybrid-nodes-cluster-update.md index b9d2f6afd..c2920f9fb 100644 --- a//eks/latest/userguide/hybrid-nodes-cluster-update.md +++ b//eks/latest/userguide/hybrid-nodes-cluster-update.md @@ -5 +5 @@ -PrerequisitesConsiderationsEnable hybrid nodes on an existing clusterNext steps: Cluster setup +PrerequisitesConsiderationsEnable hybrid nodes on an existing cluster @@ -11 +11 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -# Modify the hybrid node configuration on an existing Amazon EKS cluster +# Enable hybrid nodes on an existing Amazon EKS cluster or modify configuration @@ -15 +15 @@ This topic provides an overview of the available options and describes what to c -To enable an Amazon EKS cluster to use hybrid nodes, add the IP address CIDR ranges of your on-premises network in the `RemoteNodeNetwork` configuration. EKS uses this list of CIDRs to enable connectivity between the cluster and your on-premises networks. For a full list of configuration, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. +To enable an Amazon EKS cluster to use hybrid nodes, add the IP address CIDR ranges of your on-premises node and optionally pod network in the `RemoteNetworkConfig` configuration. EKS uses this list of CIDRs to enable connectivity between the cluster and your on-premises networks. For a full list of options when updating your cluster configuration, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. @@ -17 +17 @@ To enable an Amazon EKS cluster to use hybrid nodes, add the IP address CIDR ran -You can do any of the following actions to the EKS Hybrid Nodes in a cluster: +You can do any of the following actions to the EKS Hybrid Nodes networking configuration in a cluster: @@ -21 +21 @@ You can do any of the following actions to the EKS Hybrid Nodes in a cluster: - * Add, change, or remove the remote node networks. You can remove individual CIDR ranges but you can’t remove all remote node networks. + * Add, change, or remove the remote node networks. @@ -23 +23 @@ You can do any of the following actions to the EKS Hybrid Nodes in a cluster: - * Add, change, or remove the optional remote pod networks. + * Remove all remote node network CIDR ranges to disable EKS Hybrid Nodes in an existing cluster. @@ -25 +25 @@ You can do any of the following actions to the EKS Hybrid Nodes in a cluster: - * Remove all of the remote pod networks. + * Add, change, or remove the optional remote pod networks. @@ -27 +27 @@ You can do any of the following actions to the EKS Hybrid Nodes in a cluster: - * Remove remote node network configuration to disable EKS Hybrid Nodes in an existing cluster. + * Remove all of remote pod network CIDR ranges. @@ -36,2 +35,0 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ - * The [Prerequisite setup for hybrid nodes](./hybrid-nodes-prereqs.html) completed. Before you create your hybrid nodes-enabled cluster, you must have your on-premises node and optionally pod CIDRs identified, your VPC and subnets created according to the EKS requirements, and hybrid nodes requirements, and your security group with inbound rules for your on-premises and optionally pod CIDRs. For more information on these prerequisites, see [Prepare networking for hybrid nodes](./hybrid-nodes-networking.html). - @@ -40 +38 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ - * An [IAM principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles#iam-term-principal) with permissions to create IAM roles and attach policies, and create and describe EKS clusters + * Before enabling your Amazon EKS cluster for hybrid nodes, ensure your environment meets the requirements outlined at [Prerequisite setup for hybrid nodes](./hybrid-nodes-prereqs.html), and detailed at [Prepare networking for hybrid nodes](./hybrid-nodes-networking.html), [Prepare operating system for hybrid nodes](./hybrid-nodes-os.html), and [Prepare credentials for hybrid nodes](./hybrid-nodes-creds.html). @@ -41,0 +40 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ + * Your cluster must use IPv4 address family. @@ -42,0 +42 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ + * Your cluster must use either API or API_AND_CONFIG_MAP for the cluster authentication mode. The process for modifying the cluster authentication mode is described at [Change authentication mode to use access entries](./setting-up-access-entries.html). @@ -43,0 +44 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ + * It is recommended to use either public or private endpoint access for the Amazon EKS Kubernetes API server endpoint. If you choose “Public and Private”, the Amazon EKS Kubernetes API server endpoint will always resolve to the public IPs for hybrid nodes running outside of your VPC, which can prevent your hybrid nodes from joining the cluster. The process for modifying network access to your cluster is described at [Control network access to cluster API server endpoint](./cluster-endpoint.html). @@ -45 +46 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ -## Considerations + * An [IAM principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles#iam-term-principal) with permission to call [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) on your Amazon EKS cluster. @@ -47 +48 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ - * Your cluster must use either `API` or `API_AND_CONFIG_MAP` for the cluster authentication mode. + * Update add-ons to versions that are compatible with hybrid nodes. For the add-ons versions that are compatible with hybrid nodes, see [Configure add-ons for hybrid nodes](./hybrid-nodes-add-ons.html). @@ -49 +50 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ - * Your cluster must use IPv4 address family. + * If you are running add-ons that are not compatible with hybrid nodes, ensure that the add-on [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) or [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) has the following affinity rule to prevent deployment to hybrid nodes. Add the following affinity rule if it is not already present. @@ -51 +52,9 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ - * Your cluster must use either Public or Private cluster endpoint connectivity. Your cluster cannot use “Public and Private” cluster endpoint connectivity, because the Amazon EKS Kubernetes API server endpoint will resolve to the public IPs for hybrid nodes running outside of your VPC. + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: eks.amazonaws.com/compute-type + operator: NotIn + values: + - hybrid @@ -55,0 +65,2 @@ The following examples enable EKS Hybrid Nodes on an existing cluster and includ +## Considerations + @@ -60 +71,7 @@ The `remoteNetworkConfig` JSON object has the following behavior during an updat - * If you are modifying either of the `remoteNodeNetworks` or `remotePodNetworks` lists of CIDRs, you must specify that entire list in your update. EKS replaces the list during the update. + * If you are modifying either the `remoteNodeNetworks` or `remotePodNetworks` lists of CIDRs, you must specify the complete list of CIDRs that you want in your final configuration. When you specify a change to either the `remoteNodeNetworks` or `remotePodNetworks` CIDR list, EKS replaces the original list during the update. + + * Your on-premises node and pod CIDR blocks must meet the following requirements: + + 1. Be within one of the IPv4 RFC-1918 ranges: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. + + 2. Not overlap with each other, all CIDRs of the VPC for your Amazon EKS cluster, or your Kubernetes service IPv4 CIDR. @@ -88 +105 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 2. Continue with the next step. + 2. Continue to [Prepare cluster access for hybrid nodes](./hybrid-nodes-cluster-prep.html). @@ -95 +112 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 1. Run the following command to enable EKS Hybrid Nodes and update an EKS cluster. Before running the command, replace the following with your desired settings. For a full list of settings, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. + 1. Run the following command to enable `RemoteNetworkConfig` for EKS Hybrid Nodes for your EKS cluster. Before running the command, replace the following with your desired settings. For a full list of settings, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. @@ -97 +114 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 1. `CLUSTER_NAME`: name of the EKS cluster to be created. + 1. `CLUSTER_NAME`: name of the EKS cluster to update. @@ -99 +116 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 2. `AWS_REGION`: AWS Region where the cluster will be created. + 2. `AWS_REGION`: AWS Region where the EKS cluster is running. @@ -105,6 +121,0 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 5. Your on-premises node and pod CIDR blocks must meet the following requirements: - - 1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`. - - 2. Not overlap with each other, all CIDRs of the VPC for your Amazon EKS cluster, or your Kubernetes service IPv4 CIDR. - @@ -116 +127 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 2. It takes several minutes to update the cluster. You can query the status of your cluster with the following command. Replace `CLUSTER_NAME` with the name of the cluster you are creating and `AWS_REGION` with the AWS Region where the cluster is creating. Don’t proceed to the next step until the output returned is `ACTIVE`. + 2. It takes several minutes to update the cluster. You can query the status of your cluster with the following command. Replace `CLUSTER_NAME` with the name of the cluster you are modifying and `AWS_REGION` with the AWS Region where the cluster is running. Don’t proceed to the next step until the output returned is `ACTIVE`. @@ -123 +134 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 3. Continue with the next step. + 3. Continue to [Prepare cluster access for hybrid nodes](./hybrid-nodes-cluster-prep.html). @@ -140,8 +150,0 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 1. You must configure your remote pod CIDR if your CNI does not use Network Address Translation (NAT) or masquerading for pod IP addresses when pod traffic leaves your on-premises hosts. You must configure the remote pod CIDR if you are running webhooks on hybrid nodes. - - 2. Your on-premises node and pod CIDR blocks must meet the following requirements: - - 1. Be within one of the IPv4 RFC-1918 ranges: `10.0.0.0/8`, `172.16.0.0/12`, or `192.168.0.0/16`. - - 2. Not overlap with each other, the `VPC CIDR` for your cluster, or your Kubernetes service IPv4 CIDR. - @@ -150,4 +153 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 7. Continue with the next step. - - - + 7. Continue to [Prepare cluster access for hybrid nodes](./hybrid-nodes-cluster-prep.html). @@ -155 +154,0 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: -## Next steps: Cluster setup @@ -157 +155,0 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: -If you enable EKS Hybrid Nodes on an existing cluster, remember to update any add-ons to versions that are compatible with hybrid nodes. For the add-ons versions that are compatible with hybrid nodes, see [Configure add-ons for hybrid nodes](./hybrid-nodes-add-ons.html). Then, see [Prepare cluster access for hybrid nodes](./hybrid-nodes-cluster-prep.html) to enable access for your hybrid nodes to join your cluster. @@ -159 +156,0 @@ If you enable EKS Hybrid Nodes on an existing cluster, remember to update any ad -As soon as the cluster is in the `Active` state, the cluster is using the updated cluster configuration.