AWS eks medium security documentation change
Summary
Restructured nodeadm CLI documentation with updated commands, added security note about root/sudo requirements, expanded configuration details, and Kubernetes version updates from 1.31 to 1.32
Security assessment
Added explicit instruction to run nodeadm with root/sudo privileges under 'Important' note, which addresses privilege escalation risks. Documented security-related credential providers (SSM, IAM Roles Anywhere) and secure file locations.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-nodeadm.md b/eks/latest/userguide/hybrid-nodes-nodeadm.md index 73e926a27..4e5bf5be6 100644 --- a//eks/latest/userguide/hybrid-nodes-nodeadm.md +++ b//eks/latest/userguide/hybrid-nodes-nodeadm.md @@ -5 +5 @@ -Download nodeadmCommandsNode Config API Reference +Download nodeadmnodeadm installnodeadm config checknodeadm initnodeadm upgradenodeadm uninstallnodeadm debugNodeadm file locationsNode Config for SSM hybrid activationsNode Config for IAM Roles AnywhereNode Config for customizing kubelet (Optional)Node Config for customizing containerd (Optional) @@ -13 +13,9 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -The Amazon EKS Hybrid Nodes CLI (`nodeadm`) used for hybrid nodes lifecycle management differs from the `nodeadm` version used for bootstrapping Amazon EC2 instances as nodes in Amazon EKS clusters. Follow the documentation and references for the appropriate `nodeadm` version. This documentation page is for the hybrid nodes `nodeadm` version and the hybrid nodes `nodeadm` version is available in the [eks-hybrid repository on GitHub](https://github.com/aws/eks-hybrid). See the [nodeadm - Amazon EKS AMI documentation](https://awslabs.github.io/amazon-eks-ami/nodeadm/) for the `nodeadm` version used for Amazon EC2 instances. +The Amazon EKS Hybrid Nodes CLI (`nodeadm`) simplifies the installation, configuration, registration, and uninstallation of the hybrid nodes components. You can include `nodeadm` in your operating system images to automate hybrid node bootstrap, see [Prepare operating system for hybrid nodes](./hybrid-nodes-os.html) for more information. + +The `nodeadm` version for hybrid nodes differs from the `nodeadm` version used for bootstrapping Amazon EC2 instances as nodes in Amazon EKS clusters. Follow the documentation and references for the appropriate `nodeadm` version. This documentation page is for the hybrid nodes `nodeadm` version. + +The source code for the hybrid nodes `nodeadm` is published in the [https://github.com/aws/eks-hybrid](https://github.com/aws/eks-hybrid) GitHub repository. + +###### Important + +You must run `nodeadm` with a user that has root/sudo privileges. @@ -19 +27 @@ The hybrid nodes version of `nodeadm` is hosted in Amazon S3 fronted by Amazon C -**For x86_64 hosts:** +**For x86_64 hosts** @@ -34 +42 @@ Add executable file permission to the downloaded binary on each host. -## Commands +## `nodeadm install` @@ -36,3 +44 @@ Add executable file permission to the downloaded binary on each host. -###### Important - -You must run `nodeadm` with a user that has root/sudo privileges. +The `nodeadm install` command is used to install the artifacts and dependencies required to run and join hybrid nodes to an Amazon EKS cluster. The `nodeadm install` command can be run individually on each hybrid node or can be run during image build pipelines to preinstall the hybrid nodes dependencies in operating system images. @@ -40 +46 @@ You must run `nodeadm` with a user that has root/sudo privileges. -### Install +**Usage** @@ -42 +47,0 @@ You must run `nodeadm` with a user that has root/sudo privileges. -The `install` command is used to install the artifacts and dependencies required to run and join hybrid nodes to an Amazon EKS cluster. The `install` command can be run individually on each hybrid node or can be run during image build pipelines to preinstall the hybrid nodes dependencies in operating system images. @@ -44 +49 @@ The `install` command is used to install the artifacts and dependencies required -#### Usage + nodeadm install [KUBERNETES_VERSION] [flags] @@ -46 +51 @@ The `install` command is used to install the artifacts and dependencies required -`nodeadm install [KUBERNETES_VERSION] [flags]` +**Positional Arguments** @@ -48 +53 @@ The `install` command is used to install the artifacts and dependencies required -#### Positional Arguments +(Required) `KUBERNETES_VERSION` The major.minor version of EKS Kubernetes to install, for example `1.32` @@ -50,3 +55 @@ The `install` command is used to install the artifacts and dependencies required -(Required) `KUBERNETES_VERSION` The major.minor version of EKS Kubernetes to install, for example `1.31` - -#### Flags +**Flags** @@ -62 +65 @@ Name | Required | Description -#### Examples +**Examples** @@ -64 +67 @@ Name | Required | Description -Install Kubernetes version `1.31` with AWS Systems Manager (SSM) as the credential provider +Install Kubernetes version `1.32` with AWS Systems Manager (SSM) as the credential provider @@ -67 +70 @@ Install Kubernetes version `1.31` with AWS Systems Manager (SSM) as the credenti - nodeadm install 1.31 --credential-provider ssm + nodeadm install 1.32 --credential-provider ssm @@ -69 +72 @@ Install Kubernetes version `1.31` with AWS Systems Manager (SSM) as the credenti -Install Kubernetes version `1.31` with AWS Systems Manager (SSM) as the credential provider, Docker as the containerd source, with a download timeout of 20 minutes. +Install Kubernetes version `1.32` with AWS Systems Manager (SSM) as the credential provider, Docker as the containerd source, with a download timeout of 20 minutes. @@ -72 +75 @@ Install Kubernetes version `1.31` with AWS Systems Manager (SSM) as the credenti - nodeadm install 1.31 --credential-provider ssm --containerd-source docker --timeout 20m + nodeadm install 1.32 --credential-provider ssm --containerd-source docker --timeout 20m @@ -74 +77 @@ Install Kubernetes version `1.31` with AWS Systems Manager (SSM) as the credenti -Install Kubernetes version `1.31` with AWS IAM Roles Anywhere as the credential provider +Install Kubernetes version `1.32` with AWS IAM Roles Anywhere as the credential provider @@ -77 +80 @@ Install Kubernetes version `1.31` with AWS IAM Roles Anywhere as the credential - nodeadm install 1.31 --credential-provider iam-ra + nodeadm install 1.32 --credential-provider iam-ra @@ -79 +82 @@ Install Kubernetes version `1.31` with AWS IAM Roles Anywhere as the credential -#### Files installed +## `nodeadm config check` @@ -81,15 +84 @@ Install Kubernetes version `1.31` with AWS IAM Roles Anywhere as the credential -Artifact | Path ----|--- -IAM Roles Anywhere CLI | /usr/local/bin/aws_signing_helper -Kubelet binary | /usr/bin/kubelet -Kubectl binary | usr/local/bin/kubectl -ECR Credentials Provider | /etc/eks/image-credential-provider/ecr-credential-provider -AWS IAM Authenticator | /usr/local/bin/aws-iam-authenticator -SSM Setup CLI | /opt/ssm/ssm-setup-cli -SSM Agent | On Ubuntu - /snap/amazon-ssm-agent/current/amazon-ssm-agent On RHEL & AL2023 - /usr/bin/amazon-ssm-agent -Containerd | On Ubuntu & AL2023 - /usr/bin/containerd On RHEL - /bin/containerd -Iptables | On Ubuntu & AL2023 - /usr/sbin/iptables On RHEL - /sbin/iptables -CNI plugins | /opt/cni/bin -installed artifacts tracker | /opt/nodeadm/tracker - -### Config check +The `nodeadm config check` command checks the provided node configuration for errors. This command can be used to verify and validate the correctness of a hybrid node configuration file. @@ -97,3 +86 @@ installed artifacts tracker | /opt/nodeadm/tracker -The `config check` command checks the provided node configuration for errors. This command can be used to verify and validate the correctness of a hybrid node configuration file. - -#### Usage +**Usage** @@ -104 +91 @@ The `config check` command checks the provided node configuration for errors. Th -#### Flags +**Flags** @@ -111 +98 @@ Name | Required | Description -#### Examples +**Examples** @@ -114 +101 @@ Name | Required | Description - nodeadm config check --config-source file:///root/nodeConfig.yaml + nodeadm config check -c file://nodeConfig.yaml @@ -116 +103 @@ Name | Required | Description -### Init +## `nodeadm init` @@ -118 +105 @@ Name | Required | Description -The `init` command starts and connects the hybrid node with the configured Amazon EKS cluster. +The `nodeadm init` command starts and connects the hybrid node with the configured Amazon EKS cluster. See Node Config for SSM hybrid activations or Node Config for IAM Roles Anywhere for details of how to configure the `nodeConfig.yaml` file. @@ -120 +107 @@ The `init` command starts and connects the hybrid node with the configured Amazo -#### Usage +**Usage** @@ -125 +112 @@ The `init` command starts and connects the hybrid node with the configured Amazo -#### Flags +**Flags** @@ -133 +120 @@ Name | Required | Description -#### Examples +**Examples** @@ -136 +123 @@ Name | Required | Description - nodeadm init --config-source file://root/nodeConfig.yaml + nodeadm init -c file://nodeConfig.yaml @@ -138,22 +125 @@ Name | Required | Description -#### Files installed - -Name | Path ----|--- -Kubelet kubeconfig | /var/lib/kubelet/kubeconfig -Kubelet config | /etc/kubernetes/kubelet/config.json -Kubelet systemd unit | /etc/systemd/system/kubelet.service -Image credentials provider config | /etc/eks/image-credential-provider/config.json -Kubelet env file | /etc/eks/kubelet/environment -Kubelet Certs | /etc/kubernetes/pki/ca.crt -Containerd config | /etc/containerd/config.toml -Containerd kernel modules config | /etc/modules-load.d/contianerd.conf -AWS config file | /etc/aws/hybrid/config -AWS credentials file (if enable credentials file) | /eks-hybrid/.aws/credentials -AWS signing helper system unit | /etc/systemd/system/aws_signing_helper_update.service -Sysctl conf file | /etc/sysctl.d/99-nodeadm.conf -Apt manager files for docker repo (if containerd source is docker) | -Ca-certificates | /etc/ssl/certs/ca-certificates.crt -Gpg key file | /etc/apt/keyrings/docker.asc -Docker repo source file | /etc/apt/sources.list.d/docker.list - -### Upgrade +## `nodeadm upgrade` @@ -163 +129 @@ The `nodeadm upgrade` command upgrades all the installed artifacts to the latest -#### Usage +**Usage** @@ -168 +134 @@ The `nodeadm upgrade` command upgrades all the installed artifacts to the latest -#### Positional Arguments +**Positional Arguments** @@ -170 +136 @@ The `nodeadm upgrade` command upgrades all the installed artifacts to the latest -(Required) `KUBERNETES_VERSION` The major.minor version of EKS Kubernetes to install, for example `1.31` +(Required) `KUBERNETES_VERSION` The major.minor version of EKS Kubernetes to install, for example `1.32` @@ -172 +138 @@ The `nodeadm upgrade` command upgrades all the installed artifacts to the latest -#### Flags +**Flags** @@ -181 +147 @@ Name | Required | Description -#### Examples +**Examples** @@ -184 +150 @@ Name | Required | Description - nodeadm upgrade 1.31 --config-source file:///root/nodeConfig.yaml + nodeadm upgrade 1.32 -c file://nodeConfig.yaml @@ -187 +153 @@ Name | Required | Description - nodeadm upgrade 1.31 --config-source file:///root/nodeConfig.yaml --timeout 20m + nodeadm upgrade 1.32 -c file://nodeConfig.yaml --timeout 20m @@ -189 +155 @@ Name | Required | Description -### Uninstall +## `nodeadm uninstall` @@ -193 +159 @@ The `nodeadm uninstall` command stops and removes the artifacts `nodeadm` instal -#### Usage +**Usage** @@ -198 +164 @@ The `nodeadm uninstall` command stops and removes the artifacts `nodeadm` instal -#### Flags +**Flags** @@ -202 +168 @@ Name | Required | Description -`-s`, `--skip` | FALSE | Phases of upgrade to be skipped. It is not recommended to skip any of the phase unless it helps to fix an issue. **Values** `pod-validation` skips checking if all the no pods are running on the node, except daemon sets and static pods. `node-validation` skips checking if the node has been cordoned. `init-validation` skips checking if the node has been initialized successfully before running upgrade. +`-s`, `--skip` | FALSE | Phases of upgrade to be skipped. It is not recommended to skip any of the phase unless it helps to fix an issue. **Values** `pod-validation` skips checking if all the no pods are running on the node, except daemon sets and static pods. `node-validation` skips checking if the node has been cordoned. `init-validation` skips checking if the node has been initialized successfully before running uninstall. @@ -205 +171 @@ Name | Required | Description -#### Examples +**Examples** @@ -213 +179 @@ Name | Required | Description -### Debug +## `nodeadm debug` @@ -230 +196 @@ If errors are found, the command’s output suggests troubleshooting steps. Cert -#### Usage +**Usage** @@ -235 +201 @@ If errors are found, the command’s output suggests troubleshooting steps. Cert -#### Flags +**Flags** @@ -243 +209,24 @@ Name | Required | Description -#### Examples +**Examples** + + + nodeadm debug -c file://nodeConfig.yaml + +## Nodeadm file locations + +### nodeadm install