AWS eks documentation change
Summary
Restructured documentation to emphasize features and general considerations. Added details about managed control plane, observability integrations, networking flexibility, and infrastructure requirements. Removed standalone sections about operating systems, Kubernetes versions, networking details, security configurations, and add-ons.
Security assessment
The changes add mentions of security-adjacent features like integration with IAM Roles Anywhere and Systems Manager for identity management, but there's no evidence of addressing specific vulnerabilities. The removed 'Security for hybrid nodes' section suggests security documentation was relocated/condensed rather than patching a flaw.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-overview.md b/eks/latest/userguide/hybrid-nodes-overview.md index da2c9a43f..6ea895dc7 100644 --- a//eks/latest/userguide/hybrid-nodes-overview.md +++ b//eks/latest/userguide/hybrid-nodes-overview.md @@ -5 +5 @@ -General concepts of Amazon EKS Hybrid Nodes +FeaturesGeneral considerations @@ -19 +19 @@ With Amazon EKS Hybrid Nodes, there are no upfront commitments or minimum fees, -For an overview of the other Amazon EKS options for on-premises and edge deployments, see [Deploy Amazon EKS clusters across cloud and on-premises environments](./eks-deployment-options.html). +## Features @@ -21 +21 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym -## General concepts of Amazon EKS Hybrid Nodes +EKS Hybrid Nodes has the following high-level features: @@ -23 +23 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * Amazon EKS Hybrid Nodes must have a reliable connection between your on-premises environment and AWS. Amazon EKS Hybrid Nodes aren’t a fit for disconnected, disrupted, intermittent or limited (DDIL) environments. If you are running in a DDIL environment, consider [Amazon EKS Anywhere](https://aws.amazon.com/eks/eks-anywhere/). + * **Managed Kubernetes control plane** : AWS manages the AWS-hosted Kubernetes control plane of the EKS cluster, and you manage the hybrid nodes that run in your on-premises or edge environments. This unifies Kubernetes management across your environments and offloads Kubernetes control plane management to AWS for your on-premises and edge applications. By moving the Kubernetes control plane to AWS, you can conserve on-premises capacity for your applications and trust that the Kubernetes control plane scales with your workloads. @@ -25 +25 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * Running Amazon EKS Hybrid Nodes on cloud infrastructure, including AWS Regions, AWS Local Zones, AWS Outposts, or in other clouds, is not supported. You will be charged the hybrid nodes fee if you run hybrid nodes on Amazon EC2 instances. + * **Consistent EKS experience** : Most EKS features are supported with EKS Hybrid Nodes for a consistent EKS experience across your on-premises and cloud environments including EKS add-ons, EKS Pod Identity, cluster access entries, cluster insights, extended Kubernetes version support, and more. See [Configure add-ons for hybrid nodes](./hybrid-nodes-add-ons.html) for more information on the EKS add-ons supported with EKS Hybrid Nodes. @@ -27 +27 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * A single Amazon EKS cluster can be used to run hybrid nodes and nodes in AWS Regions, AWS Local Zones, or AWS Outposts. See [Considerations for mixed mode clusters](./hybrid-nodes-webhooks.html#hybrid-nodes-considerations-mixed-mode) for more information. + * **Centralized observability and identity management** : EKS Hybrid Nodes natively integrates with AWS services including AWS Systems Manager, AWS IAM Roles Anywhere, Amazon Managed Service for Prometheus, and Amazon CloudWatch for centralized monitoring, logging, and identity management. @@ -29 +29 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * Amazon EKS Hybrid Nodes is available in all AWS Regions, except the AWS GovCloud (US) Regions and the AWS China Regions. + * **Burst-to-cloud or add on-premises capacity** : A single EKS cluster can be used to run hybrid nodes and nodes in AWS Regions, AWS Local Zones, or AWS Outposts to burst-to-cloud or add on-premises capacity to your EKS clusters. See [Considerations for mixed mode clusters](./hybrid-nodes-webhooks.html#hybrid-nodes-considerations-mixed-mode) for more information. @@ -31 +31 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * Billing for hybrid nodes starts when the nodes join the Amazon EKS cluster and stops when the nodes are removed from the cluster. Be sure to remove your hybrid nodes from your Amazon EKS cluster if you are not using them. + * **Flexible infrastructure** : EKS Hybrid Nodes follows a _bring your own infrastructure_ approach and is agnostic to the infrastructure you use for hybrid nodes. You can run hybrid nodes on physical or virtual machines, and x86 and ARM architectures, making it possible to migrate on-premises workloads running on hybrid nodes across different infrastructure types. @@ -32,0 +33 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym + * **Flexible networking** : With EKS Hybrid Nodes, communication between the EKS control plane and hybrid nodes is routed through the VPC and subnets you pass during cluster creation, which builds on the [existing mechanism](https://docs.aws.amazon.com/eks/latest/best-practices/subnets.html) in EKS for control plane to node networking. This is flexible to your preferred method of connecting your on-premises networks to a VPC in AWS. There are several [documented options](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/network-to-amazon-vpc-connectivity-options.html) available including AWS Site-to-Site VPN, AWS Direct Connect, or your own VPN solution, and you can choose the method that best fits your use case. @@ -36 +36,0 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym -**Infrastructure Management** @@ -38 +38 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * Amazon EKS Hybrid Nodes follows a _bring your own infrastructure_ approach where it is your responsibility to provision and manage the physical or virtual machines and the operating system you use for hybrid nodes. +## General considerations @@ -40 +40 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym - * Amazon EKS Hybrid Nodes are agnostic to the infrastructure they run on. You can run hybrid nodes on physical or virtual machines, and x86 and ARM architectures. + * EKS Hybrid Nodes can be used with new or existing EKS clusters. @@ -41,0 +42 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym + * EKS Hybrid Nodes is available in all AWS Regions, except the AWS GovCloud (US) Regions and the AWS China Regions. @@ -42,0 +44 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym + * EKS Hybrid Nodes must have a reliable connection between your on-premises environment and AWS. EKS Hybrid Nodes is not a fit for disconnected, disrupted, intermittent or limited (DDIL) environments. If you are running in a DDIL environment, consider [Amazon EKS Anywhere](https://aws.amazon.com/eks/eks-anywhere/). @@ -43,0 +46 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym + * Running EKS Hybrid Nodes on cloud infrastructure, including AWS Regions, AWS Local Zones, AWS Outposts, or in other clouds, is not supported. You will be charged the hybrid nodes fee if you run hybrid nodes on Amazon EC2 instances. @@ -45,76 +48 @@ For an overview of the other Amazon EKS options for on-premises and edge deploym -**Operating Systems for hybrid nodes** - - * **Amazon Linux 2023 (AL2023)** : You can use Amazon Linux 2023 (AL2023) as the node operating system for hybrid nodes, but only in virtualized environments such as VMWare, KVM, and Hyper-V. AWS supports the integration of hybrid nodes with AL2023, but AL2023 isn’t covered by the AWS Support Plans when you run it outside of Amazon EC2. - - * **Ubuntu** : You can use Ubuntu 20.04, Ubuntu 22.04, and Ubuntu 24.04 as the node operating system for hybrid nodes. - - * **Red Hat Enterprise Linux (RHEL)** : You can use RHEL 8 and RHEL 9 as the node operating system for hybrid nodes. - - - - -**Kubernetes versions** - - * Amazon EKS Hybrid Nodes supports the same Kubernetes versions and deprecation schedule as Amazon EKS, including standard and extended Kubernetes version support. For more information on Kubernetes versions in Amazon EKS, see [Understand the Kubernetes version lifecycle on EKS](./kubernetes-versions.html). - - * Amazon EKS Hybrid Nodes can be used with new or existing Amazon EKS clusters. - - - - -**Networking** - - * The communication between the Amazon EKS control plane and hybrid nodes is routed through the VPC and subnets you pass during cluster creation, which builds on the [existing mechanism](https://docs.aws.amazon.com/eks/latest/best-practices/subnets.html) in Amazon EKS for control plane to node networking. - - * Amazon EKS Hybrid Nodes is flexible to your preferred method of connecting your on-premises networks to a VPC in AWS. There are several [documented options](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/network-to-amazon-vpc-connectivity-options.html) available including AWS Site-to-Site VPN and AWS Direct Connect, and you can choose the method that best fits your use case. - - * **IP address family** : Hybrid nodes can be used with Amazon EKS clusters configured with the `IPv4` IP address family only. You can’t use Amazon EKS clusters configured with the `IPv6` IP address family. Similarly, your on-premises node and Pod CIDRs must be `IPv4` RFC1918 CIDR blocks. - - * You must enable the required domains, protocols, and ports for Amazon EKS Hybrid Nodes in your on-premises environments and firewalls. For more information, including minimum networking requirements, see [Prepare networking for hybrid nodes](./hybrid-nodes-networking.html). - - * **Cluster endpoint access** : You can use “Public” or “Private” cluster endpoint access. You should not use “Public and Private” cluster endpoint access, as the endpoint DNS resolution will always resolve to the public addresses for queries originating from your on-premises environment. - - * For information and best practices during scenarios where there are network disconnections between hybrid nodes and the AWS Region, see the [hybrid nodes](https://docs.aws.amazon.com/eks/latest/best-practices/hybrid-nodes.html) section of the _Amazon EKS Best Practices Guide_. - - * **Application load balancing** : Kubernetes has a [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object to define the names and domain names for your applications and resolve and load balance to them. By default, the `type:LoadBalancer` type of Service additionally creates an AWS Classic Load Balancer for traffic from outside the cluster. You can change this behavior with add-ons. Specifically, we recommend the AWS Application Load Balancer and AWS Network Load Balancer which are created by the AWS Load Balancer Controller, instead of the AWS Classic Load Balancer. For steps to install the AWS Load Balancer Controller in a hybrid environment, see [AWS Load Balancer Controller](./hybrid-nodes-add-ons.html#hybrid-nodes-add-ons-lbc). - - - - -**Security for hybrid nodes** - - * Amazon EKS Hybrid Nodes use temporary IAM credentials to authenticate with your Amazon EKS cluster. You can use either AWS IAM Roles Anywhere or AWS Systems Manager (SSM) hybrid activations for provisioning the on-premises IAM credentials for hybrid nodes. It is recommended to use AWS SSM hybrid activations if you do not have existing Public Key Infrastructure (PKI) with a Certificate Authority (CA) and certificates for your on-premises environments. If you do have existing PKI and certificates on-premises, use AWS IAM Roles Anywhere. - - * You can use `API` or `API_AND_CONFIG_MAP` cluster authentication modes for your hybrid nodes-enabled Amazon EKS clusters. Use the cluster access entry type called `HYBRID_LINUX` with your hybrid nodes IAM role to enable hybrid nodes to join the Amazon EKS cluster. - - * OIDC authentication is supported for hybrid nodes-enabled Amazon EKS clusters. - - * You can use Amazon EKS Pod Identities and IAM Roles for Service Accounts (IRSA) with applications running on hybrid nodes to enable granular access for your Pods running on hybrid nodes with other AWS services. - - * You can use Amazon GuardDuty EKS Protection with hybrid nodes-enabled Amazon EKS clusters to analyze activities of users and applications accessing your cluster. - - - - -**Add-ons for hybrid nodes** - -For detailed information, see [Configure add-ons for hybrid nodes](./hybrid-nodes-add-ons.html). - - * **Container Networking Interface (CNI)** : The AWS VPC CNI can’t be used with hybrid nodes. The core capabilities of Cilium and Calico are supported for use with hybrid nodes. You can manage your CNI with your choice of tooling such as Helm. For more information, see [Configure a CNI for hybrid nodes](./hybrid-nodes-cni.html). - - * **`kube-proxy` and CoreDNS**: `kube-proxy` and CoreDNS are installed automatically when hybrid nodes join the Amazon EKS cluster. These add-ons can be managed as Amazon EKS add-ons after cluster creation. - - * **Ingress and Load Balancing** : You can use the AWS Load Balancer Controller and Application Load Balancer (ALB) or Network Load Balancer (NLB) with the target type `ip` for workloads on hybrid nodes connected with AWS Direct Connect or AWS Site-to-Site VPN. You can alternatively use your choice of Ingress controller or load balancer for application traffic that stays local to your on-premises environment. - - * **Metrics** : You can use Amazon Managed Prometheus (AMP) agent-less scrapers, AWS Distro for Open Telemetry (ADOT), and the Amazon CloudWatch Observability Agent with hybrid nodes. To use AMP agent-less scrapers for Pod metrics on hybrid nodes, your Pods must be accessible from the VPC that you use for the Amazon EKS cluster. - - * **Logs** : You can enable Amazon EKS control plane logging for hybrid nodes-enabled clusters. You can use the ADOT EKS add-on and the Amazon CloudWatch Observability Agent EKS add-on for hybrid node and Pod logging. - - - - -**User interfaces** - - * **Node management** : The Amazon EKS Hybrid Nodes CLI is called `nodeadm` and is run on each on-premises host to simplify the installation, configuration, registration, and uninstall of the hybrid nodes components. The hybrid nodes `nodeadm` version is different than the `nodeadm` version used in the AL2023 Amazon EKS-optimized AMIs. You should not use the hybrid nodes `nodeadm` version for nodes running in Amazon EC2. - - * **Cluster management** : The Amazon EKS user interfaces for cluster management are the same with hybrid nodes-enabled Amazon EKS clusters. This includes the AWS Management Console, AWS API, AWS SDKs, AWS CLI, eksctl CLI, AWS CloudFormation, and Terraform. + * Billing for hybrid nodes starts when the nodes join the EKS cluster and stops when the nodes are removed from the cluster. Be sure to remove your hybrid nodes from your EKS cluster if you are not using them.