AWS eks documentation change
Summary
Updated version formatting (added 'v' prefix) for Cilium and Calico versions, added Kubernetes version support note, grammatical improvements, and documentation clarifications
Security assessment
Changes include version number formatting adjustments, grammatical improvements (e.g., 'may' to 'might'), and clarifications about network configuration best practices. While some changes mention security-adjacent concepts like pod CIDR routability and BGP configuration, there is no evidence these changes address specific vulnerabilities or security incidents. Recommendations to use latest patch versions are general maintenance advice rather than security-specific guidance.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-cni.md b/eks/latest/userguide/hybrid-nodes-cni.md index e6a2990a4..0b93d8ca3 100644 --- a//eks/latest/userguide/hybrid-nodes-cni.md +++ b//eks/latest/userguide/hybrid-nodes-cni.md @@ -17 +17 @@ Cilium and Calico are supported as the Container Networking Interfaces (CNIs) fo -Cilium version `1.16.x` is supported and recommended for EKS Hybrid Nodes for every Kubernetes version supported in Amazon EKS. +Cilium version `v1.16.x` is supported and recommended for EKS Hybrid Nodes for every Kubernetes version supported in Amazon EKS. @@ -19 +19,3 @@ Cilium version `1.16.x` is supported and recommended for EKS Hybrid Nodes for ev -Calico version `3.29.x` is supported and recommended for EKS Hybrid Nodes for every Kubernetes version supported in Amazon EKS. +Calico version `v3.29.x` is supported and recommended for EKS Hybrid Nodes for every Kubernetes version supported in Amazon EKS. + +See [Kubernetes version support](./kubernetes-versions.html) for the Kubernetes versions supported by Amazon EKS. EKS Hybrid Nodes have the same Kubernetes version support as Amazon EKS clusters with cloud nodes. @@ -42 +44 @@ BGP | Yes (Cilium Control Plane) | Yes - * If you are running webhooks on your hybrid nodes, your pod CIDRs must be routable on your on-premises network and you must configure your Amazon EKS cluster with your remote pod networks. If your pod CIDRs are not routable on your on-premises network, then it is recommended to run webhooks on cloud nodes in the same cluster. See [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html) for more information. + * If you are running webhooks on your hybrid nodes, your pod CIDRs must be routable on your on-premises network and you must configure your Amazon EKS cluster with your remote pod networks. If your pod CIDRs are not routable on your on-premises network, then we recommend that you run webhooks on cloud nodes in the same cluster. See [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html) for more information. @@ -101 +103 @@ BGP | Yes (Cilium Control Plane) | Yes - * Replace `CILIUM_VERSION` with your desired Cilium version. It is recommended to run the latest patch version for your Cilium minor version. You can find the latest patch release for a given minor Cilium release in the [Stable Releases section](https://github.com/cilium/cilium#stable-releases) of the Cilium documentation. + * Replace `CILIUM_VERSION` with a Calico version (for example `v3.29.0`). We recommend that you run the latest patch version for your Cilium minor version. You can find the latest patch release for a given minor Cilium release in the [Stable Releases section](https://github.com/cilium/cilium#stable-releases) of the Cilium documentation. @@ -125 +127 @@ BGP | Yes (Cilium Control Plane) | Yes - 6. To use BGP with Cilium to advertise your pod addresses with your on-premises network, you must have installed Cilium with `bgpControlPlane.enabled: true`. To configure BGP in Cilium, first create a file called `cilium-bgp-cluster.yaml` with a `CiliumBGPClusterConfig` with the `peerAddress` set to your on-premises router IP that you are peering with. Configure the `localASN` and `peerASN` based on your on-premises router configuration, which you may have to obtain from your network administrator. + 6. To use BGP with Cilium to advertise your pod addresses with your on-premises network, you must have installed Cilium with `bgpControlPlane.enabled: true`. To configure BGP in Cilium, first create a file called `cilium-bgp-cluster.yaml` with a `CiliumBGPClusterConfig` with the `peerAddress` set to your on-premises router IP that you are peering with. Configure the `localASN` and `peerASN` based on your on-premises router configuration, which you might have to obtain from your network administrator. @@ -176 +178 @@ BGP | Yes (Cilium Control Plane) | Yes - 10. The `CiliumBGPAdvertisement` resource is used to define various advertisement types and attributes associated with them. Create a file named `cilium-bgp-advertisement.yaml` and configure the `CiliumBGPAdvertisement` resource with your desired settings. + 10. The `CiliumBGPAdvertisement` resource is used to define various advertisement types and attributes associated with them. Create a file named `cilium-bgp-advertisement.yaml` and configure the `CiliumBGPAdvertisement` resource with your settings. @@ -240 +242 @@ Before upgrading your Cilium deployment, carefully review the [Cilium upgrade do - 7. During normal cluster operations, all Cilium components should run the same version. The following steps describe how to upgrade all of the components from one stable release to a later stable release. When upgrading from one minor release to another minor release, it is recommended to upgrade to the latest patch release for the existing Cilium minor version first. To minimize disruption, set the `upgradeCompatibility` option to the initial Cilium version that you installed in this cluster. + 7. During normal cluster operations, all Cilium components should run the same version. The following steps describe how to upgrade all of the components from one stable release to a later stable release. When upgrading from one minor release to another minor release, we recommend that you upgrade to the latest patch release for the existing Cilium minor version first. To minimize disruption, set the `upgradeCompatibility` option to the initial Cilium version that you installed in this cluster. @@ -242 +244 @@ Before upgrading your Cilium deployment, carefully review the [Cilium upgrade do -Before running the helm upgrade command, preserve the values for your deployment in a `cilium-values.yaml` or use `--set` command line options for your settings. The upgrade operation overwrites the Cilium ConfigMap, so it is critical that your configuration values are passed when you upgrade. If you are using BGP, it is recommended to use the `--set bgpControlPlane=true` command line option instead of supplying this information in your values file. +Before running the helm upgrade command, preserve the values for your deployment in a `cilium-values.yaml` or use `--set` command line options for your settings. The upgrade operation overwrites the Cilium ConfigMap, so it is critical that your configuration values are passed when you upgrade. If you are using BGP, we recommend that you use the `--set bgpControlPlane=true` command line option instead of supplying this information in your values file. @@ -259 +261 @@ Before running the helm upgrade command, preserve the values for your deployment - 1. Run the following command to uninstall all Cilium components from your cluster. Note, uninstalling the CNI may impact the health of nodes and pods and shouldn’t be performed on production clusters. + 1. Run the following command to uninstall all Cilium components from your cluster. Note, uninstalling the CNI might impact the health of nodes and pods and shouldn’t be performed on production clusters. @@ -276 +278 @@ The interfaces and routes configured by Cilium are not removed by default when t - * It is recommended to run Calico in overlay / tunnel mode with VXLAN as the [encapsulation method](https://docs.tigera.io/calico/latest/networking/configuring/vxlan-ipip). This mode has the fewest requirements on the underlying physical network. For more information on the different Calico networking modes, see [Determining the best networking option](https://docs.tigera.io/calico/latest/networking/determine-best-networking) in the Calico documentation. + * We recommend that you run Calico in overlay / tunnel mode with VXLAN as the [encapsulation method](https://docs.tigera.io/calico/latest/networking/configuring/vxlan-ipip). This mode has the fewest requirements on the underlying physical network. For more information on the different Calico networking modes, see [Determining the best networking option](https://docs.tigera.io/calico/latest/networking/determine-best-networking) in the Calico documentation. @@ -278 +280 @@ The interfaces and routes configured by Cilium are not removed by default when t - * It is recommended to run Calico with `natOutgoing` set to `true`. With `natOutgoing` set to `true`, the source IP address of all pod traffic leaving the cluster is translated to the IP address of the node. This makes it possible to run Calico with Amazon EKS clusters, whether or not remote pod networks are configured on the cluster. If you disable `natOutgoing`, then your pod CIDRs must be routable on your on-premises network and you must configure your Amazon EKS cluster with your remote pod networks. + * We recommend that you run Calico with `natOutgoing` set to `true`. With `natOutgoing` set to `true`, the source IP address of all pod traffic leaving the cluster is translated to the IP address of the node. This makes it possible to run Calico with Amazon EKS clusters, whether or not remote pod networks are configured on the cluster. If you disable `natOutgoing`, then your pod CIDRs must be routable on your on-premises network and you must configure your Amazon EKS cluster with your remote pod networks. @@ -280 +282 @@ The interfaces and routes configured by Cilium are not removed by default when t - * If you are running webhooks on your hybrid nodes, your pod CIDRs must be routable on your on-premises network and you must configure your Amazon EKS cluster with your remote pod networks. If your pod CIDRs are not routable on your on-premises network, then it is recommended to run webhooks on cloud nodes in the same cluster. See [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html) for more information. + * If you are running webhooks on your hybrid nodes, your pod CIDRs must be routable on your on-premises network and you must configure your Amazon EKS cluster with your remote pod networks. If your pod CIDRs are not routable on your on-premises network, then we recommend that you run webhooks on cloud nodes in the same cluster. See [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html) for more information. @@ -349 +351 @@ The interfaces and routes configured by Cilium are not removed by default when t - * Replace `CALICO_VERSION` with your desired Calico version (for example 3.29.0), see the [Calico releases](https://github.com/projectcalico/calico/releases) to find the latest patch release for your Calico minor version. It is recommended to run the latest patch version for the Calico minor version. + * Replace `CALICO_VERSION` with a Calico version (for example `v3.29.0`), see the [Calico releases](https://github.com/projectcalico/calico/releases) to find the latest patch release for your Calico minor version. We recommend that you run the latest patch version for the Calico minor version. @@ -378 +380 @@ The interfaces and routes configured by Cilium are not removed by default when t - 6. If you installed Calico without BGP, skip this step. To configure BGP, create a file called `calico-bgp.yaml` with a `BGPPeer` configuration and a `BGPConfiguration`. It is important to distinguish `BGPPeer` and `BGPConfiguration`. The `BGPPeer` is the BGP-enabled router or remote resource with which the nodes in a Calico cluster will peer. The `asNumber` in the `BGPPeer` configuration is similar to the Cilium setting `peerASN` . The `BGPConfiguration` is applied to each Calico node and the `asNumber` for the `BGPConfiguration` is equivalent to the Cilium setting `localASN`. Replace `ONPREM_ROUTER_IP`, `ONPREM_ROUTER_ASN`, and `LOCAL_ASN` in the example below with the values for your on-premises environment, which you may have to obtain from your network administrator. The `keepOriginalNextHop: true` setting is used to ensure each node advertises only the pod network CIDR that it owns. + 6. If you installed Calico without BGP, skip this step. To configure BGP, create a file called `calico-bgp.yaml` with a `BGPPeer` configuration and a `BGPConfiguration`. It is important to distinguish `BGPPeer` and `BGPConfiguration`. The `BGPPeer` is the BGP-enabled router or remote resource with which the nodes in a Calico cluster will peer. The `asNumber` in the `BGPPeer` configuration is similar to the Cilium setting `peerASN` . The `BGPConfiguration` is applied to each Calico node and the `asNumber` for the `BGPConfiguration` is equivalent to the Cilium setting `localASN`. Replace `ONPREM_ROUTER_IP`, `ONPREM_ROUTER_ASN`, and `LOCAL_ASN` in the example below with the values for your on-premises environment, which you might have to obtain from your network administrator. The `keepOriginalNextHop: true` setting is used to ensure each node advertises only the pod network CIDR that it owns. @@ -466 +468 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Delete hybrid nodes +Configure @@ -468 +470 @@ Delete hybrid nodes -Configure webhooks +Configure add-ons