AWS eks documentation change
Summary
Updated Node Class configuration documentation with IAM role requirements, security group name changes, KMS encryption options, certificate bundles, and tag restrictions
Security assessment
Added documentation for KMS key encryption configuration and certificate bundles which are security features. However, there's no evidence these changes address an existing security vulnerability.
Diff
diff --git a/eks/latest/userguide/create-node-class.md b/eks/latest/userguide/create-node-class.md index 493ad5bf4..f958442c1 100644 --- a//eks/latest/userguide/create-node-class.md +++ b//eks/latest/userguide/create-node-class.md @@ -5 +5 @@ -Create a Node ClassCreate node class access entryNode Class Specification +Create a Node ClassCreate node class access entryNode Class SpecificationConsiderations @@ -110,0 +111,2 @@ For information about deploying CloudFormation stacks, see [Getting started with + # Required fields + role: MyNodeRole # IAM role for EC2 instances @@ -112 +113,0 @@ For information about deploying CloudFormation stacks, see [Getting started with - # Required: Subnet selection for node placement @@ -115 +116 @@ For information about deploying CloudFormation stacks, see [Getting started with - Name: "<tag-name>" + Name: "private-subnet" @@ -120 +120,0 @@ For information about deploying CloudFormation stacks, see [Getting started with - # Required: Security group selection for nodes @@ -123 +123 @@ For information about deploying CloudFormation stacks, see [Getting started with - Name: "eks-cluster-node-sg" + Name: "eks-cluster-sg" @@ -126 +126 @@ For information about deploying CloudFormation stacks, see [Getting started with - # - name: "eks-cluster-node-security-group" + # - name: "eks-cluster-security-group" @@ -128 +128 @@ For information about deploying CloudFormation stacks, see [Getting started with - # Optional: Configure SNAT policy (defaults to Random) + # Optional fields @@ -131 +130,0 @@ For information about deploying CloudFormation stacks, see [Getting started with - # Optional: Network policy configuration (defaults to DefaultAllow) @@ -133,2 +131,0 @@ For information about deploying CloudFormation stacks, see [Getting started with - - # Optional: Network policy event logging (defaults to Disabled) @@ -137 +133,0 @@ For information about deploying CloudFormation stacks, see [Getting started with - # Optional: Configure ephemeral storage (shown with default values) @@ -142,7 +138,14 @@ For information about deploying CloudFormation stacks, see [Getting started with - - # Optional: Name of IAM role to use for EC2 instance role - # If unspecified, EKS creates a role - # If specified, you must create an access entry for this role as described above - role: MyNodeRole - - # Optional: Additional EC2 tags + # Optional KMS key for encryption + kmsKeyID: "arn:aws:kms:region:account:key/key-id" + # Accepted formats: + # KMS Key ID + # KMS Key ARN + # Key Alias Name + # Key Alias ARN + + # Optional: Custom certificate bundles + certificateBundles: + - name: "custom-cert" + data: "base64-encoded-cert-data" + + # Optional: Additional EC2 tags (with restrictions) @@ -152,2 +155,9 @@ For information about deploying CloudFormation stacks, see [Getting started with - -**Considerations:** + # Note: Cannot use restricted tags like: + # - kubernetes.io/cluster/* + # - karpenter.sh/provisioner-name + # - karpenter.sh/nodepool + # - karpenter.sh/nodeclaim + # - karpenter.sh/managed-by + # - eks.amazonaws.com/nodeclass + +## Considerations