AWS eks documentation change
Summary
Updated EKS Hybrid Nodes documentation with reorganization of AWS CLI instructions, authentication mode formatting, explicit API endpoint configuration recommendations, and CIDR list update clarifications.
Security assessment
The documentation now explicitly advises against using both public and private API server endpoints to prevent hybrid nodes from failing to join the cluster, which could mitigate misconfiguration risks. It also emphasizes proper CIDR list management to avoid unintended network access. While these are security-adjacent best practices, there is no direct evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-cluster-update.md b/eks/latest/userguide/hybrid-nodes-cluster-update.md index b69377bee..f3d959865 100644 --- a//eks/latest/userguide/hybrid-nodes-cluster-update.md +++ b//eks/latest/userguide/hybrid-nodes-cluster-update.md @@ -13 +13 @@ To contribute to this user guide, choose the **Edit this page on GitHub** link t -This topic provides an overview of the available options and describes what to consider when you add, change, or remove the hybrid nodes configuration from an Amazon EKS cluster. If you are not planning to use hybrid nodes, see [Create an Amazon EKS cluster](./create-cluster.html). +This topic provides an overview of the available options and describes what to consider when you add, change, or remove the hybrid nodes configuration for an Amazon EKS cluster. @@ -30,2 +29,0 @@ You can do any of the following actions to the EKS Hybrid Nodes networking confi - * The latest version of the AWS Command Line Interface (AWS CLI) installed and configured on your device. To check your current version, use `aws --version`. Package managers such yum, apt-get, or Homebrew for macOS are often several versions behind the latest version of the AWS CLI. To install the latest version, see [Installing or updating to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [Configuring settings for the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-config) in the AWS Command Line Interface User Guide. - @@ -36 +34 @@ You can do any of the following actions to the EKS Hybrid Nodes networking confi - * Your cluster must use either API or API_AND_CONFIG_MAP for the cluster authentication mode. The process for modifying the cluster authentication mode is described at [Change authentication mode to use access entries](./setting-up-access-entries.html). + * Your cluster must use either `API` or `API_AND_CONFIG_MAP` for the cluster authentication mode. The process for modifying the cluster authentication mode is described at [Change authentication mode to use access entries](./setting-up-access-entries.html). @@ -38 +36,3 @@ You can do any of the following actions to the EKS Hybrid Nodes networking confi - * It is recommended to use either public or private endpoint access for the Amazon EKS Kubernetes API server endpoint. If you choose “Public and Private”, the Amazon EKS Kubernetes API server endpoint will always resolve to the public IPs for hybrid nodes running outside of your VPC, which can prevent your hybrid nodes from joining the cluster. The process for modifying network access to your cluster is described at [Control network access to cluster API server endpoint](./cluster-endpoint.html). + * We recommend that you use either public or private endpoint access for the Amazon EKS Kubernetes API server endpoint, but not both. If you choose “Public and Private”, the Amazon EKS Kubernetes API server endpoint will always resolve to the public IPs for hybrid nodes running outside of your VPC, which can prevent your hybrid nodes from joining the cluster. The process for modifying network access to your cluster is described at [Control network access to cluster API server endpoint](./cluster-endpoint.html). + + * The latest version of the AWS Command Line Interface (AWS CLI) installed and configured on your device. To check your current version, use `aws --version`. Package managers such yum, apt-get, or Homebrew for macOS are often several versions behind the latest version of the AWS CLI. To install the latest version, see [Installing or updating to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [Configuring settings for the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-config) in the AWS Command Line Interface User Guide. @@ -106 +106 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: - 1. Run the following command to enable `RemoteNetworkConfig` for EKS Hybrid Nodes for your EKS cluster. Before running the command, replace the following with your desired settings. For a full list of settings, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. + 1. Run the following command to enable `RemoteNetworkConfig` for EKS Hybrid Nodes for your EKS cluster. Before running the command, replace the following with your settings. For a full list of settings, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. @@ -154 +154 @@ You can enable EKS Hybrid Nodes in an existing cluster by using: -You can modify `remoteNetworkConfig` in an existing hybrid cluster using: +You can modify `remoteNetworkConfig` in an existing hybrid cluster by using any of the following: @@ -177 +177 @@ You can modify `remoteNetworkConfig` in an existing hybrid cluster using: -When updating `RemoteNodeNetworks` or `RemotePodNetworks` CIDR lists, include all desired CIDRs (new and existing). EKS replaces the entire list during updates. Omitting these fields from the update request retains their existing configurations. +When updating `RemoteNodeNetworks` or `RemotePodNetworks` CIDR lists, include all CIDRs (new and existing). EKS replaces the entire list during updates. Omitting these fields from the update request retains their existing configurations. @@ -186 +186 @@ When updating `RemoteNodeNetworks` or `RemotePodNetworks` CIDR lists, include al - 1. To modify the remote network CIDRs, run the following command. Replace the values with your desired settings: + 1. To modify the remote network CIDRs, run the following command. Replace the values with your settings: @@ -195 +195 @@ When updating `RemoteNodeNetworks` or `RemotePodNetworks` CIDR lists, include al -When updating `remoteNodeNetworks` or `remotePodNetworks` CIDR lists, include all desired CIDRs (new and existing). EKS replaces the entire list during updates. Omitting these fields from the update request retains their existing configurations. +When updating `remoteNodeNetworks` or `remotePodNetworks` CIDR lists, include all CIDRs (new and existing). EKS replaces the entire list during updates. Omitting these fields from the update request retains their existing configurations. @@ -245 +245 @@ You can disable EKS Hybrid Nodes in an existing cluster by using: - 1. Run the following command to remove `RemoteNetworkConfig` from your EKS cluster. Before running the command, replace the following with your desired settings. For a full list of settings, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_. + 1. Run the following command to remove `RemoteNetworkConfig` from your EKS cluster. Before running the command, replace the following with your settings. For a full list of settings, see the [UpdateClusterConfig](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html) in the _Amazon EKS API Reference_.