AWS eks documentation change
Summary
Updated prerequisites and added 'Considerations' section clarifying IAM role reuse across clusters, IRSA requirements, and OIDC provider management for AWS Load Balancer Controller installation
Security assessment
Changes focus on IAM role management and IRSA configuration which are security-related features, but there's no evidence of addressing a specific vulnerability. The updates improve documentation about security best practices for role reuse and cluster-specific OIDC requirements.
Diff
diff --git a/eks/latest/userguide/lbc-helm.md b/eks/latest/userguide/lbc-helm.md index e1e44b0b5..3c3a48acf 100644 --- a//eks/latest/userguide/lbc-helm.md +++ b//eks/latest/userguide/lbc-helm.md @@ -25 +25 @@ In the following steps, replace the `example values` with your own values. -Before starting this tutorial, you must install and configure the following tools and resources that you need to create and manage an Amazon EKS cluster. +Before starting this tutorial, you must complete the following steps: @@ -27 +27 @@ Before starting this tutorial, you must install and configure the following tool - * An existing Amazon EKS cluster. To deploy one, see [Get started with Amazon EKS](./getting-started.html). + * Create an Amazon EKS cluster. To create one, see [Get started with Amazon EKS](./getting-started.html). @@ -29 +29 @@ Before starting this tutorial, you must install and configure the following tool - * An existing AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster. To determine whether you already have one, or to create one, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html). + * Install [Helm](https://helm.sh/docs/helm/helm_install/) on your local machine. @@ -33 +33 @@ Before starting this tutorial, you must install and configure the following tool - * Familiarity with AWS Elastic Load Balancing. For more information, see the [Elastic Load Balancing User Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/). + * Learn about AWS Elastic Load Balancing concepts. For more information, see the [Elastic Load Balancing User Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/). @@ -35 +35 @@ Before starting this tutorial, you must install and configure the following tool - * Familiarity with Kubernetes [service](https://kubernetes.io/docs/concepts/services-networking/service/) and [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resources. + * Learn about Kubernetes [service](https://kubernetes.io/docs/concepts/services-networking/service/) and [ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resources. @@ -37 +36,0 @@ Before starting this tutorial, you must install and configure the following tool - * [Helm](https://helm.sh/docs/helm/helm_install/) installed locally. @@ -40,0 +40 @@ Before starting this tutorial, you must install and configure the following tool +### Considerations @@ -42 +42,7 @@ Before starting this tutorial, you must install and configure the following tool -## Step 1: Create IAM Role using `eksctl` +Before proceeding with the configuration steps on this page, consider the following: + + * The IAM policy and role (`AmazonEKSLoadBalancerControllerRole`) can be reused across multiple EKS clusters in the same AWS account. + + * If you’re installing the controller on the same cluster where the role (`AmazonEKSLoadBalancerControllerRole`) was originally created, go to Step 2: Install Load Balancer Controller after verifying the role exists. + + * If you’re using IAM Roles for Service Accounts (IRSA), IRSA must be set up for each cluster, and the OpenID Connect (OIDC) provider ARN in the role’s trust policy is specific to each EKS cluster. Additionally, if you’re installing the controller on a new cluster with an existing `AmazonEKSLoadBalancerControllerRole`, update the role’s trust policy to include the new cluster’s OIDC provider and create a new service account with the appropriate role annotation. To determine whether you already have an OIDC provider, or to create one, see [Create an IAM OIDC provider for your cluster](./enable-iam-roles-for-service-accounts.html). @@ -44 +49,0 @@ Before starting this tutorial, you must install and configure the following tool -###### Note @@ -46 +51,5 @@ Before starting this tutorial, you must install and configure the following tool -Below example is referring to the AWS Load Balancer Controller **v2.12.0** release version. For more information about all releases, see the [AWS Load Balancer Controller Release Page](https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/) on GitHub. + + +## Step 1: Create IAM Role using `eksctl` + +The following steps refer to the AWS Load Balancer Controller **v2.12.0** release version. For more information about all releases, see the [AWS Load Balancer Controller Release Page](https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/) on GitHub.