AWS eks documentation change
Summary
Added cert-manager, Prometheus Node Exporter, and kube-state-metrics to supported add-ons, with configuration details for cert-manager webhooks
Security assessment
While cert-manager relates to certificate management (a security feature), the changes primarily document compatibility and configuration requirements without addressing specific vulnerabilities. The webhook configuration guidance improves security posture but doesn't fix a known issue.
Diff
diff --git a/eks/latest/userguide/hybrid-nodes-add-ons.md b/eks/latest/userguide/hybrid-nodes-add-ons.md index 4d0726cf0..691660d24 100644 --- a//eks/latest/userguide/hybrid-nodes-add-ons.md +++ b//eks/latest/userguide/hybrid-nodes-add-ons.md @@ -5 +5 @@ -AWS add-onskube-proxy and CoreDNSCloudWatch Observability agentAmazon Managed Prometheus managed collector for hybrid nodesAWS Distro for OpenTelemetry (ADOT)AWS Load Balancer ControllerEKS Pod Identity AgentCSI snapshot controllerCommunity add-onsKubernetes Metrics Server +AWS add-onskube-proxy and CoreDNSCloudWatch Observability agentAmazon Managed Prometheus managed collector for hybrid nodesAWS Distro for OpenTelemetry (ADOT)AWS Load Balancer ControllerEKS Pod Identity AgentCSI snapshot controllerCommunity add-onsKubernetes Metrics Servercert-manager @@ -31,0 +32,3 @@ Kubernetes Metrics Server | v0.7.2-eksbuild.1 and above +cert-manager | v1.17.2-eksbuild.1 and above +Prometheus Node Exporter | v1.9.1-eksbuild.2 and above +kube-state-metrics | v2.15.0-eksbuild.4 and above @@ -33 +36 @@ Kubernetes Metrics Server | v0.7.2-eksbuild.1 and above -In addition to the Amazon EKS add-ons in the tables above, the [Amazon Managed Service for Prometheus Collector](./prometheus.html), and the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) for [application ingress](./alb-ingress.html) (HTTP) and [load balancing](./network-load-balancing.html) (TCP/UDP) are compatible with hybrid nodes. +In addition to the Amazon EKS add-ons in the tables above, the [Amazon Managed Service for Prometheus Collector](./prometheus.html), and the [AWS Load Balancer Controller](./aws-load-balancer-controller.html) for [application ingress](./alb-ingress.html) (HTTP) and [load balancing](./network-load-balancing.html) (TCP/UDP) are compatible with hybrid nodes. The [AWS Private Certificate Authority cert-manager plugin](https://github.com/cert-manager/aws-privateca-issuer) is also compatible with EKS Hybrid Nodes. @@ -157,0 +161,4 @@ The control plane needs to reach Metrics Server’s pod IP (or node IP if hostNe +## cert-manager + +`cert-manager` uses [webhooks](https://kubernetes.io/docs/reference/access-authn-authz/webhook/). If you run `cert-manager` on hybrid nodes, your on-premises pod CIDR must be routable on your on-premises network and you must configure your EKS cluster with your remote pod network. For more information, see [Configure webhooks for hybrid nodes](./hybrid-nodes-webhooks.html). +